def search(self, parms):
device_controller = DeviceController(self.db, self.logger)
if "location" in parms.keys():
list_location_ip = device_controller.get_device_list_by_locationid(
parms["location"])
if "device" in parms.keys():
list_device_ip = device_controller.get_device_list_by_hostname(
parms["device"])
#Doing intersection between device search and device in location
search_ip = list(set(list_location_ip) & set(list_device_ip))
print search_ip
query_search = []
if search_ip:
query_search.append(Query.terms('host', search_ip))
if parms["time"]:
time_from = parms["time"]["from"].split(" ")[0]
time_to = parms["time"]["to"].split(" ")[0]
query_search.append(
Query.range('@timestamp', gte=time_from, lte=time_to))
if parms["severityLevel"]:
query_search.append(
Query.terms('severity', parms["severityLevel"]))
if parms["keywordMessage"]:
message_search = []
message_search.append(parms["keywordMessage"])
query_search.append(Query.terms('message', message_search))
index = "syslog*"
es = Elasticsearch(["http://192.168.100.249:9200"])
q = ElasticQuery(es=es, index=index, doc_type='doc')
# q.query(Query.match_all())
q.size(1000)
q.query(Query.bool(must=query_search))
#q.query(Aggregate.terms(must=query_search))
print q.json(indent=4)
query_result = self.format_results(q.get())
return query_result
#No index to query
else:
return []
},
'NESTED_FILTER': {}
}
# Test filters
print '[ElasticQuery] Testing: filters & queries'
query = Query.range('field_name1', gt=0, lte=100)[1]
test('Query.range', query, FILTERS['RANGE'])
query = Query.prefix(field_name1='value_name1')[1]
test('Query.prefix', query, FILTERS['PREFIX'])
query = Query.term(field_name1='value_name1')[1]
test('Query.term', query, FILTERS['TERM'])
query = Query.terms(field_name1=['value_name1', 'value_name2'])[1]
test('Query.terms', query, FILTERS['TERMS'])
query = Filter.missing('field_name1')[1]
test('Filter.missing', query, FILTERS['FILTER_MISSING'])
query = Query.missing('field_name1')[1]
test('Query.missing', query, FILTERS['QUERY_MISSING'])
query = Query.raw_string('QUERYSTRING')[1]
test('Query.raw_string', query, FILTERS['RAW_STRING'])
query = Query.string(field_name1='value_name1',
field_name2=['value_name2', 'value_name3'])[1]
test('Query.string', query, FILTERS['STRING'])
# Aggregates: