def __call__(self, pipeline):
response = {}
for event in pipeline:
if self.groups:
for group in self.groups:
if group in event:
_key = (group, event[group])
if _key not in response:
response[_key] = {}
for field in self.fields:
_x = response[_key]
if (_x.get(field, None)):
_x[field] = min(_x[field], event[field])
else:
_x[field] = event[field]
else:
for field in self.fields:
if (response.get(field, None)):
response[field] = min(response[field], event[field])
else:
response[field] = event[field]
if self.groups:
for (gkey, gval) in response:
for f in response[(gkey, gval)]:
yield Event({
gkey: gval,
("min(%s)" % f): response[(gkey, gval)][f]
})
else:
for key in response:
yield Event({("min(%s)" % key): response[key]})
def __call__(self, pipeline):
response = {}
for event in pipeline:
if self.groups:
for group in self.groups:
if group in event:
_key = (group, event[group])
if _key not in response:
response[_key] = {}
for field in self.fields:
_x = response[_key]
if (_x.get(field, None)):
_x[field]["count"] += 1
try:
_x[field]["sum"] += float(event[field])
except ValueError:
pass
else:
try:
_x[field] = {
"count": 1,
"sum": float(event[field])
}
except ValueError:
pass
else:
for field in self.fields:
if (response.get(field, None)):
response[field]["count"] += 1
try:
response[field]["sum"] += float(event[field])
except ValueError:
pass
else:
try:
response[field] = {
"count": 1,
"sum": float(event[field])
}
except ValueError:
response[field] = {"count": 1, "sum": 0}
if self.groups:
for (gkey, gval) in response:
for f in response[(gkey, gval)]:
r = response[(gkey, gval)][f]
yield Event({
gkey: gval,
("avg(%s)" % f): r["sum"] / r["count"]
})
else:
for key in response:
r = response[key]
yield Event({("avg(%s)" % key): r["sum"] / r["count"]})
def __call__(self, pipeline):
for event in pipeline:
new_event = Event()
for field in self.fields:
if field in event:
new_event[field] = event[field]
yield new_event
def __call__(self, pipeline):
for event in pipeline:
netstr = NetString.from_buffer(event)
netstr = netstr.decode()
if isinstance(netstr, dict):
yield Event(netstr)
else:
yield netstr
def __call__(self, pipeline):
ret = []
field = self.field
for event in pipeline:
if len(ret) and (event.time - ret[0].time) > self.span.seconds:
yield Event({
field: self.func(field, ret),
"_time": ret[0]["_time"]
})
ret = [event]
else:
ret.append(event)
if len(ret) and (event.time - ret[0].time) > self.span.seconds:
yield Event({
field: self.func(field, ret),
"_time": ret[0]["_time"]
})
def __call__(self, pipeline):
if not self.fields and not self.groups:
count = 0
for x in pipeline:
count += 1
yield Event({"count": count})
else:
response = {}
for event in pipeline:
if self.groups:
for group in self.groups:
if group in event:
_key = (group, event[group])
if _key not in response:
response[_key] = {}
for field in self.fields:
if (response[_key].get(field, None)):
response[_key][field] += 1
else:
response[_key][field] = 1
else:
for field in self.fields:
if (response.get(field, None)):
response[field] += 1
else:
response[field] = 1
if self.groups:
for (gkey, gval) in response:
for f in response[(gkey, gval)]:
yield Event({
gkey:
gval,
("count(%s)" % f):
response[(gkey, gval)][f]
})
else:
for key in response:
yield Event({("count(%s)" % key): response[key]})
def __call__(self, pipeline):
ret = []
for event in pipeline:
if len(self.fields) == len(filter(lambda x:x in event, self.fields)):
if len(ret) >= self.maxevents:
yield Event.merge(ret)
ret = [ event ]
elif self.startswith and event._raw.startswith(self.startswith):
yield Event.merge(ret)
ret = [ event ]
elif self.endswith and event._raw.endswith(self.endswith):
ret.append(event)
yield Event.merge(ret)
elif self.maxspan and len(ret) and \
(event.time - ret[0].time) > self.maxspan.seconds:
yield Event.merge(ret)
ret = [ event ]
else:
ret.append(event)
if ret:
yield Event.merge(ret)
def __call__(self, pipeline):
for line in pipeline:
line = line.rstrip("\r\n")
ev_dict = self.re.match(line)
if ev_dict:
ev_dict = ev_dict.groupdict()
else:
ev_dict = {}
ev_dict["_raw"] = line
try:
_x = Event(ev_dict)
yield _x
except EventError:
continue
def __call__(self, pipeline):
ret = []
for event in pipeline:
if len(self.fields) == len(
filter(lambda x: x in event, self.fields)):
if len(ret) >= self.maxevents:
yield Event.merge(ret)
ret = [event]
elif self.startswith and event._raw.startswith(
self.startswith):
yield Event.merge(ret)
ret = [event]
elif self.endswith and event._raw.endswith(self.endswith):
ret.append(event)
yield Event.merge(ret)
elif self.maxspan and len(ret) and \
(event.time - ret[0].time) > self.maxspan.seconds:
yield Event.merge(ret)
ret = [event]
else:
ret.append(event)
if ret:
yield Event.merge(ret)
def __iter__(self, search):
try:
self.connect()
self.sock.sendall(search)
f = self.sock.makefile()
for event in f:
if self._stop:
break
netstr = NetString.from_buffer(event)
yield Event(netstr.decode())
finally:
self._stop = True
self.sock.close()
def __call__(self, pipeline):
for line in pipeline:
ev_dict = dict(self.re.findall(line))
ev_dict["_raw"] = line.rstrip("\r\n")
yield Event(ev_dict)