plunk 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f4347fcd85f52a27bcf5f88860aafb1723ba4dbe
-  data.tar.gz: 6e61f5fddc8d46739a2ab022811ee0ed0dae370e
+  metadata.gz: 1aaa198f780c8d3c6f9538cd86a7ee20fbf4d44c
+  data.tar.gz: 4cb13fb58000bf09dca9fa3001077a2b46474c41
 SHA512:
-  metadata.gz: 7260262be415b410743081d51ac61c80383d8dcf26cff42adbfbbb8f85ac2f2268edf7c6e431abfe7ea91cdb08c609ed042bd6fc48f3602bb2c64d520239c920
-  data.tar.gz: 04e0993e9818842f23efd04febb9eefd79c90afa2450d196882e31b9f7bb9ff4596e02b2643d019f59338a21a464518f43dea6488d0f112fce62f9ce0dd948e1
+  metadata.gz: a994a69ca9c8557f07869aaff1eb468773346caa06d5676e68cdea867d0e6642cb3bd573e419f557a224beb11c6a386a7189851b2f166a3ce74884f5a8e0e802
+  data.tar.gz: bfbd1504b80387dd2b3695a030cbb9be35110052f9b5ec8857b4415d048219e9519e71d4f6849575c67b8d878da94dff80bd3fb52b39407385d3185f4170168a

data/README.md

@@ -2,3 +2,35 @@ plunk
 =====
 
 Human-friendly query language for Elasticsearch
+
+Examples:
+
+```last 24h _type=syslog```
+
+gets translated to:
+
+```json
+{
+  "query": {
+    "filtered": {
+      "query": {
+        "query_string": {
+          "query": "_type:syslog"
+        }
+      },
+      "filter": {
+        "and": [
+          {
+            "range": {
+              "timestamp": {
+                "gte": "2013-08-23T05:43:13.770Z",
+                "lte": "2013-08-24T05:43:13.770Z"
+              }
+            }
+          }
+        ]
+      }
+    }
+  }
+}
+```

data/lib/plunk/result_set.rb

@@ -1,29 +1,35 @@
 class Plunk::ResultSet
-  attr_accessor :query
+  attr_accessor :query, :query_string
 
-  def initialize(opts=nil)
-    if opts
-      @query = { query: { }}
-      
-      if @query_string = opts[:query_string]
-        @query[:query][:query_string] = { query: opts[:query_string] }
-      end
+  def initialize(opts={})
+    @query = { query: { filtered: {}}}
 
-      if opts[:start_time] and opts[:end_time]
-        @query[:query][:range] = {
-          '@timestamp' => {
-            gte: opts[:start_time],
-            lte: opts[:end_time]
-          }
-        }
+    if opts.size >= 3 # use "and" filter to AND filters
+      @query_string = opts[:query_string]
+      @query[:query][:filtered][:query] = {
+        query_string: {
+          query: opts[:query_string] }}
+      @query[:query][:filtered][:filter] = {
+        and: [
+          range: {
+            '@timestamp' => {
+              gte: opts[:start_time],
+              lte: opts[:end_time] }}]}
+    else
+      if @query_string = opts[:query_string]
+        @query[:query][:filtered][:query] = {
+          query_string: {
+            query: opts[:query_string] }}
+      elsif opts[:start_time] and opts[:end_time]
+        @query[:query][:filtered][:query] = {
+          range: {
+            '@timestamp' => {
+              gte: opts[:start_time],
+              lte: opts[:end_time] }}}
       end
     end
   end
 
-  def raw_query
-    @query_string
-  end
-
   def eval
     @@elasticsearch.search(@query.to_json) if @query
   end

data/lib/plunk/transformer.rb

@@ -137,7 +137,7 @@ class Plunk::Transformer < Parslet::Transform
     end_time = Time.now
 
     Plunk::ResultSet.new(
-      query_string: result_set.raw_query,
+      query_string: result_set.query_string,
       start_time: start_time.utc.to_datetime.iso8601(3),
       end_time: end_time.utc.to_datetime.iso8601(3))
   end

data/plunk.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name                    = "plunk"
-  s.version                 = "0.1.3"
+  s.version                 = "0.1.4"
   s.date                    = "2013-12-03"
   s.add_runtime_dependency  "json"
   s.add_runtime_dependency  "parslet"

data/spec/basic_spec.rb

@@ -3,10 +3,8 @@ require 'spec_helper'
 describe 'basic searches' do
   it 'should parse' do
     result = @transformer.apply @parser.parse('bar')
-    result.query.should eq({
-      query: {
-        query_string: {
-          query: 'bar'
-    }}})
+    result.query.should eq({query:{filtered:{query:{query_string:{
+      query: 'bar'
+    }}}}})
   end
 end

data/spec/boolean_spec.rb

@@ -3,19 +3,15 @@ require 'spec_helper'
 describe 'boolean searches' do
   it 'should parse (foo OR bar)' do
     result = @transformer.apply @parser.parse '(foo OR bar)'
-    expect(result.query).to eq({
-      query: {
-        query_string: {
-          query: '(foo OR bar)'
-    }}})
+    expect(result.query).to eq({query:{filtered:{query:{query_string:{
+      query: '(foo OR bar)'
+    }}}}})
   end
 
   it 'should parse (foo OR (bar AND baz))' do
     result = @transformer.apply @parser.parse '(foo OR (bar AND baz))'
-    expect(result.query).to eq({
-      query: {
-        query_string: {
-          query: '(foo OR (bar AND baz))'
-    }}})
+    expect(result.query).to eq({query:{filtered:{query:{query_string:{
+      query: '(foo OR (bar AND baz))'
+    }}}}})
   end
 end

data/spec/chained_search_spec.rb

@@ -0,0 +1,24 @@
+require 'spec_helper'
+
+describe 'chained searches' do
+  it 'should parse last 24h foo=bar baz=fez' do
+    result = @transformer.apply @parser.parse 'last 24h foo=bar baz=fez'
+    puts result
+    expect(result.query).to eq({query:{filtered:{query:{
+      range: {
+        '@timestamp' => {
+          gte: 1.day.ago.utc.iso8601(3),
+          lte: Time.now.utc.iso8601(3)
+        }
+      },
+      filter: {
+        and: [
+          query_string: {
+            query: 'foo:bar'
+          },
+          query_string: {
+            query: 'baz:fez'
+          }
+    ]}}}}})
+  end
+end

data/spec/field_value_spec.rb

@@ -3,19 +3,15 @@ require 'spec_helper'
 describe 'field / value searches' do
   it 'should parse a single _foo.@bar=baz' do
     result = @transformer.apply @parser.parse('_foo.@bar=baz')
-    expect(result.query).to eq({
-      query: {
-        query_string: {
-          query: '_foo.@bar:baz'
-    }}})
+    expect(result.query).to eq({query:{filtered:{query:{query_string:{
+      query: '_foo.@bar:baz'
+    }}}}})
   end
 
   it 'should parse a single _foo.@bar=(baz)' do
     result = @transformer.apply @parser.parse('_foo.@bar=(baz)')
-    expect(result.query).to eq({
-      query: {
-        query_string: {
-          query: '_foo.@bar:(baz)'
-    }}})
+    expect(result.query).to eq({query:{filtered:{query:{query_string:{
+      query: '_foo.@bar:(baz)'
+    }}}}})
   end
 end

data/spec/last_spec.rb

@@ -3,70 +3,67 @@ require 'spec_helper'
 describe 'the last command' do
   it 'should parse last 24h' do
     result = @transformer.apply @parser.parse('last 24h')
-    expect(result.query.to_s).to eq({
-      query: {
-        range: {
-          '@timestamp' => {
-            gte: 24.hours.ago.utc.to_datetime.iso8601(3),
-            lte: Time.now.utc.to_datetime.iso8601(3)
-    }}}}.to_s)
+    expect(result.query.to_s).to eq({query:{filtered:{query:{
+      range: {
+        '@timestamp' => {
+          gte: 24.hours.ago.utc.to_datetime.iso8601(3),
+          lte: Time.now.utc.to_datetime.iso8601(3)
+    }}}}}}.to_s)
   end
 
   it 'should parse last 24d' do
     result = @transformer.apply @parser.parse('last 24d')
-    expect(result.query.to_s).to eq({
-      query: {
-        range: {
-          '@timestamp' => {
-            gte: 24.days.ago.utc.to_datetime.iso8601(3),
-            lte: Time.now.utc.to_datetime.iso8601(3)
-    }}}}.to_s)
+    expect(result.query.to_s).to eq({query:{filtered:{query:{
+      range: {
+        '@timestamp' => {
+          gte: 24.days.ago.utc.to_datetime.iso8601(3),
+          lte: Time.now.utc.to_datetime.iso8601(3)
+    }}}}}}.to_s)
   end
 
   it 'should parse last 24w' do
     result = @transformer.apply @parser.parse('last 24w')
-    expect(result.query.to_s).to eq({
-      query: {
-        range: {
-          '@timestamp' => {
-            gte: 24.weeks.ago.utc.to_datetime.iso8601(3),
-            lte: Time.now.utc.to_datetime.iso8601(3)
-    }}}}.to_s)
+    expect(result.query.to_s).to eq({query:{filtered:{query:{
+      range: {
+        '@timestamp' => {
+          gte: 24.weeks.ago.utc.to_datetime.iso8601(3),
+          lte: Time.now.utc.to_datetime.iso8601(3)
+    }}}}}}.to_s)
   end
 
   it 'should parse last 24s' do
     result = @transformer.apply @parser.parse('last 24s')
-    expect(result.query.to_s).to eq({
-      query: {
-        range: {
-          '@timestamp' => {
-            gte: 24.seconds.ago.utc.to_datetime.iso8601(3),
-            lte: Time.now.utc.to_datetime.iso8601(3)
-    }}}}.to_s)
+    expect(result.query.to_s).to eq({query:{filtered:{query:{
+      range: {
+        '@timestamp' => {
+          gte: 24.seconds.ago.utc.to_datetime.iso8601(3),
+          lte: Time.now.utc.to_datetime.iso8601(3)
+    }}}}}}.to_s)
   end
 
   it 'should parse last 24m' do
     result = @transformer.apply @parser.parse('last 24m')
-    expect(result.query.to_s).to eq({
-      query: {
-        range: {
-          '@timestamp' => {
-            gte: 24.minutes.ago.utc.to_datetime.iso8601(3),
-            lte: Time.now.utc.to_datetime.iso8601(3)
-    }}}}.to_s)
+    expect(result.query.to_s).to eq({query:{filtered:{query:{
+      range: {
+        '@timestamp' => {
+          gte: 24.minutes.ago.utc.to_datetime.iso8601(3),
+          lte: Time.now.utc.to_datetime.iso8601(3)
+    }}}}}}.to_s)
   end
 
   it 'should parse last 1h foo=bar' do
     result = @transformer.apply @parser.parse('last 1h foo=bar')
-    expect(result.query.to_s).to eq({
-      query: {
+    expect(result.query.to_s).to eq({query:{filtered:{
+      query:{
         query_string: {
           query: 'foo:bar'
-        },
-        range: {
-          '@timestamp' => {
-            gte: 1.hour.ago.utc.to_datetime.iso8601(3),
-            lte: Time.now.utc.to_datetime.iso8601(3)
-    }}}}.to_s)
+      }},
+      filter: {
+        and: [
+          range: {
+            '@timestamp' => {
+              gte: 1.hour.ago.utc.to_datetime.iso8601(3),
+              lte: Time.now.utc.to_datetime.iso8601(3)
+    }}]}}}}.to_s)
   end
 end

data/spec/nested_search_spec.rb

@@ -13,11 +13,9 @@ describe 'nested searches' do
 
   it 'should transform' do
     results = @transformer.apply @parser.parse('foo=`bar=baz|baz`')
-    expect(results.query).to eq({
-      query: {
-        query_string: {
-          query: 'foo:(5)'
-    }}})
+    expect(results.query).to eq({query:{filtered:{query:{query_string:{
+      query: 'foo:(5)'
+    }}}}})
   end
 
   it 'should parse a nested basic search' do

data/spec/regexp_spec.rb

@@ -3,10 +3,8 @@ require 'spec_helper'
 describe 'regexp searches' do
   it 'should parse foo=/blah foo/' do
     result = @transformer.apply @parser.parse('foo=/blah foo/')
-    expect(result.query).to eq({
-      query: {
-        query_string: {
-          query: 'foo:/blah foo/'
-    }}})
+    expect(result.query).to eq({query:{filtered:{query:{query_string:{
+      query: 'foo:/blah foo/'
+    }}}}})
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: plunk
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: ruby
 authors:
 - Ram Mehta