module RawActions
Public Instance Methods
events(from, to, args)
click to toggle source
# File lib/sawyer/actions_raw.rb, line 32 def events from, to, args qs = args.shift logs = args $stdin.read.split("\n").each do |l| logs << l.split(' ', 2).last end unless $stdin.tty? unless logs.empty? logs = logs.map do |log| host, path = log.split('/', 2) if path.nil? || path.empty? 'host:"%s"' % host else '(host:"%s" AND path:"/%s")' % [ host, path ] end end.join(' OR ') logs = " AND (#{logs})" else logs = '' end request = { query: { query_string: { query: qs + logs } } } response = search from, to, request if response.has_key?('hits') puts JSON::pretty_generate(response['hits']['hits'].map { |e| e['_source'] }) return 0 end return 1 end
logs(from, to, args)
click to toggle source
# File lib/sawyer/actions_raw.rb, line 2 def logs from, to, args qs = args.shift request = { size: 0, query: { query_string: { query: qs } }, aggregations: { logs: { terms: { script: "_source.host + _source.path" } } } } response = search from, to, request buckets = [] if response.has_key? 'aggregations' buckets = response['aggregations']['logs']['buckets'] end logs = buckets.map { |log| "%d\t%s" % [ log['doc_count'], log['key'] ] } puts logs.reverse return 0 end