module RawActions

Public Instance Methods

events(from, to, args) click to toggle source
# File lib/sawyer/actions_raw.rb, line 32
def events from, to, args
  qs   = args.shift
  logs = args

  $stdin.read.split("\n").each do |l|
    logs << l.split(' ', 2).last
  end unless $stdin.tty?

  unless logs.empty?
    logs = logs.map do |log|
      host, path = log.split('/', 2)
      if path.nil? || path.empty?
        'host:"%s"' % host
      else
        '(host:"%s" AND path:"/%s")' % [ host, path ]
      end
    end.join(' OR ')
    logs = " AND (#{logs})"
  else
    logs = ''
  end

  request = {
    query: {
      query_string: {
        query: qs + logs
      }
    }
  }

  response = search from, to, request
  if response.has_key?('hits')
    puts JSON::pretty_generate(response['hits']['hits'].map { |e| e['_source'] })
    return 0
  end
  return 1
end
logs(from, to, args) click to toggle source
# File lib/sawyer/actions_raw.rb, line 2
def logs from, to, args
  qs = args.shift
  request = {
    size: 0,
    query: {
      query_string: {
        query: qs
      }
    },
    aggregations: {
      logs: {
        terms: {
          script: "_source.host + _source.path"
        }
      }
    }
  }

  response = search from, to, request
  buckets = []
  if response.has_key? 'aggregations'
    buckets = response['aggregations']['logs']['buckets']
  end
  logs = buckets.map { |log| "%d\t%s" % [ log['doc_count'], log['key'] ] }
  puts logs.reverse
  return 0
end