plunk 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c4f868a5bed9e1cf6ff92fd7a7ea3462d24bfe5e
-  data.tar.gz: 363a7b6e9826388f0a8eeb5e3ccf921858d6095e
+  metadata.gz: f4347fcd85f52a27bcf5f88860aafb1723ba4dbe
+  data.tar.gz: 6e61f5fddc8d46739a2ab022811ee0ed0dae370e
 SHA512:
-  metadata.gz: 8e0cd1903d55eb547fede49935a166b62b7c7aa23e736f88b6fd283278f3b3f7e4a10e33d0190902dca4a905c69604fe66dcb8e87c67871007770f18f4551324
-  data.tar.gz: 49fb10179eaa5e6f2c63901350cfd7befc033ac1e326e5f07fd63f577ea9848f95dd859bc0d72d9e9cd91d466ad84dcf2a5ba408cbb56c1ac16c29057adf4db2
+  metadata.gz: 7260262be415b410743081d51ac61c80383d8dcf26cff42adbfbbb8f85ac2f2268edf7c6e431abfe7ea91cdb08c609ed042bd6fc48f3602bb2c64d520239c920
+  data.tar.gz: 04e0993e9818842f23efd04febb9eefd79c90afa2450d196882e31b9f7bb9ff4596e02b2643d019f59338a21a464518f43dea6488d0f112fce62f9ce0dd948e1

data/lib/plunk/result_set.rb

@@ -24,7 +24,7 @@ class Plunk::ResultSet
     @query_string
   end
 
-  def eval(elasticsearch)
-    elasticsearch.search(@query.to_json) if @query
+  def eval
+    @@elasticsearch.search(@query.to_json) if @query
   end
 end

data/lib/plunk/transformer.rb

@@ -3,6 +3,56 @@ require 'active_support/core_ext'
 
 class Plunk::Transformer < Parslet::Transform
 
+  rule(
+    field: simple(:field),
+    value: {
+      initial_query: subtree(:initial_query),
+      extractors: simple(:extractors)
+    },
+    op: '=',
+    timerange: {
+      quantity: simple(:quantity),
+      quantifier: simple(:quantifier)
+    }) do
+
+    int_quantity = quantity.to_s.to_i
+
+    start_time =
+      case quantifier
+      when 's'
+        int_quantity.seconds.ago
+      when 'm'
+        int_quantity.minutes.ago
+      when 'h'
+        int_quantity.hours.ago
+      when 'd'
+        int_quantity.days.ago
+      when 'w'
+        int_quantity.weeks.ago
+      end
+
+    end_time = Time.now
+
+
+    # recursively apply nested query
+    result_set = Plunk::Transformer.new.apply(initial_query)
+
+    json = JSON.parse result_set.eval
+    values = Plunk::Elasticsearch.extract_values json, extractors.to_s.split(',') 
+
+    if values.empty?
+      Plunk::ResultSet.new(
+        start_time: start_time.utc.to_datetime.iso8601(3),
+        end_time: end_time.utc.to_datetime.iso8601(3))
+        
+    else
+      Plunk::ResultSet.new(
+        query_string: "#{field}:(#{values.uniq.join(' OR ')})",
+        start_time: start_time.utc.to_datetime.iso8601(3),
+        end_time: end_time.utc.to_datetime.iso8601(3))
+    end
+  end
+
   rule(match: simple(:value)) do
     Plunk::ResultSet.new(query_string: "#{value}")
   end
@@ -18,7 +68,7 @@ class Plunk::Transformer < Parslet::Transform
     # recursively apply nested query
     result_set = Plunk::Transformer.new.apply(initial_query)
 
-    json = JSON.parse result_set.eval @@elasticsearch
+    json = JSON.parse result_set.eval
     values = Plunk::Elasticsearch.extract_values json, extractors.to_s.split(',') 
 
     if values.empty?

data/plunk.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name                    = "plunk"
-  s.version                 = "0.1.2"
+  s.version                 = "0.1.3"
   s.date                    = "2013-12-03"
   s.add_runtime_dependency  "json"
   s.add_runtime_dependency  "parslet"

data/spec/last_spec.rb

@@ -3,7 +3,6 @@ require 'spec_helper'
 describe 'the last command' do
   it 'should parse last 24h' do
     result = @transformer.apply @parser.parse('last 24h')
-    puts "QUERY: #{result.query}"
     expect(result.query.to_s).to eq({
       query: {
         range: {
@@ -57,7 +56,7 @@ describe 'the last command' do
     }}}}.to_s)
   end
 
-  it 'should parse foo=bar last 1h' do
+  it 'should parse last 1h foo=bar' do
     result = @transformer.apply @parser.parse('last 1h foo=bar')
     expect(result.query.to_s).to eq({
       query: {

data/spec/nested_search_spec.rb

@@ -1,12 +1,12 @@
 require 'spec_helper'
 
 describe 'nested searches' do
-  before :all do
+  before :each do
     fake_results = {
       foo: 'bar',
       baz: 5,
       arr: [ 0, 1, 2, 3 ],
-      '@timestamp' => Time.now
+      '@timestamp' => Time.now.utc.iso8601(3)
     }.to_json
     Plunk::ResultSet.any_instance.stub(:eval).and_return(fake_results)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: plunk
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Ram Mehta