plunk 0.0.10 → 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: a659a0a283f124f49496afa4cca6987f8c922d5d
4
- data.tar.gz: 545c1203a5f86c97ac4eb32e8a515c84c36f342a
3
+ metadata.gz: 1f4ae213e6780d0beabd3c1d1595424aa75b041a
4
+ data.tar.gz: 00bd1c4fab440ccc2bc140f0243f6f9769e0f6f8
5
5
  SHA512:
6
- metadata.gz: c92655505f884b6b95231fd923620948ca9d67fa32610d0c416e408a39696d44baa752b14ac0482d1a77f9a061c41544f5d662cd84f7e6178c1670d5abed7b42
7
- data.tar.gz: cb2b3e91a07b221b954aabe2f9ae0711e267ef7a68f4dc4fdfb16482534135d59761e7773897716021b6cd3d755f89bd3aebd2061998acd9ca7845ac32abf6b1
6
+ metadata.gz: 05df593ab809765d85a480c9a6056599be8b8843023a473c5621cd4d49e878e26e40f168edc5375666de0596600790dfe168c462bac54191efab9b0c2423e1b7
7
+ data.tar.gz: b5dd04ae58e43e338259f171a421ab9cbc19096675ef78379d62adbf62a86a78c1f1703c270986b0d9669c342985fe1feca2157bf9c922c0ff5ea7118c5676c9
@@ -57,7 +57,7 @@ class Plunk::Elasticsearch
57
57
  end
58
58
 
59
59
  # nested field matcher
60
- def extract_values(hash, keys)
60
+ def self.extract_values(hash, keys)
61
61
  @vals ||= []
62
62
 
63
63
  hash.each_pair do |k, v|
@@ -10,20 +10,21 @@ class Plunk::Transformer < Parslet::Transform
10
10
  rule(
11
11
  field: simple(:field),
12
12
  value: {
13
- term: simple(:term),
13
+ initial_query: subtree(:initial_query),
14
14
  extractors: simple(:extractors)
15
15
  },
16
16
  op: '=') do
17
17
 
18
- rs = Plunk::ResultSet.new(query_string: "#{field}:#{term}")
18
+ # recursively apply nested query
19
+ result_set = Plunk::Transformer.new.apply(initial_query)
19
20
 
20
- json = JSON.parse rs.eval
21
+ json = JSON.parse result_set.eval
21
22
  values = Plunk::Elasticsearch.extract_values json, extractors.to_s.split(',')
22
23
 
23
24
  if values.empty?
24
25
  Plunk::ResultSet.new
25
26
  else
26
- Plunk::ResultSet.new(query_string: "(#{values.uniq.join(' OR ')})")
27
+ Plunk::ResultSet.new(query_string: "#{field}:(#{values.uniq.join(' OR ')})")
27
28
  end
28
29
  end
29
30
 
data/plunk.gemspec CHANGED
@@ -1,6 +1,6 @@
1
1
  Gem::Specification.new do |s|
2
2
  s.name = "plunk"
3
- s.version = "0.0.10"
3
+ s.version = "0.1.0"
4
4
  s.date = "2013-12-03"
5
5
  s.add_runtime_dependency "json"
6
6
  s.add_runtime_dependency "parslet"
data/spec/last_spec.rb CHANGED
@@ -55,4 +55,18 @@ describe 'the last command' do
55
55
  lte: Time.now
56
56
  }}}}.to_s)
57
57
  end
58
+
59
+ it 'should parse foo=bar last 1h' do
60
+ result = @transformer.apply @parser.parse('last 1h foo=bar')
61
+ expect(result.query.to_s).to eq({
62
+ query: {
63
+ query_string: {
64
+ query: 'foo:bar'
65
+ },
66
+ range: {
67
+ '@timestamp' => {
68
+ gte: 1.hour.ago,
69
+ lte: Time.now
70
+ }}}}.to_s)
71
+ end
58
72
  end
@@ -1,6 +1,25 @@
1
1
  require 'spec_helper'
2
2
 
3
3
  describe 'nested searches' do
4
+ before :all do
5
+ fake_results = {
6
+ foo: 'bar',
7
+ baz: 5,
8
+ arr: [ 0, 1, 2, 3 ],
9
+ '@timestamp' => Time.now
10
+ }.to_json
11
+ Plunk::ResultSet.any_instance.stub(:eval).and_return(fake_results)
12
+ end
13
+
14
+ it 'should transform' do
15
+ results = @transformer.apply @parser.parse('foo=`bar=baz|baz`')
16
+ expect(results.query).to eq({
17
+ query: {
18
+ query_string: {
19
+ query: 'foo:(5)'
20
+ }}})
21
+ end
22
+
4
23
  it 'should parse a nested basic search' do
5
24
  @parsed = @parser.parse 'tshark.len = ` 226 | tshark.frame.time_epoch,tshark.ip.src`'
6
25
  expect(@parsed[:field].to_s).to eq 'tshark.len'
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: plunk
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.0.10
4
+ version: 0.1.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Ram Mehta