org.graylog.events.search

Class MoreSearch

java.lang.Object

org.graylog2.indexer.searches.Searches

org.graylog.events.search.MoreSearch

public class MoreSearch
extends Searches

This class contains search helper for the events system.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	MoreSearch.Result
static interface	MoreSearch.ScrollCallback Callback that receives message batches from scrollQuery(String, Set, TimeRange, int, ScrollCallback).

Nested classes/interfaces inherited from class org.graylog2.indexer.searches.Searches

Searches.DateHistogramInterval, Searches.TermsStatsOrder

Field Summary

Fields inherited from class org.graylog2.indexer.searches.Searches

AGG_CARDINALITY, AGG_EXTENDED_STATS, AGG_FILTER, AGG_HISTOGRAM, AGG_STATS, AGG_TERMS, AGG_TERMS_STATS, AGG_VALUE_COUNT, STACKED_TERMS_AGG_SEPARATOR

Constructor Summary

Constructors

Constructor and Description
MoreSearch(StreamService streamService, Indices indices, IndexRangeService indexRangeService, IndexSetRegistry indexSetRegistry, com.codahale.metrics.MetricRegistry metricRegistry, ScrollResult.Factory scrollResultFactory, io.searchbox.client.JestClient jestClient, Configuration configuration)

Method Summary

Modifier and Type	Method and Description
Set<Stream>	loadStreams(Set<String> streamIds)
void	scrollQuery(String queryString, Set<String> streams, TimeRange timeRange, int batchSize, MoreSearch.ScrollCallback resultCallback) This scrolls results for the given query, streams and time range from Elasticsearch.

Methods inherited from class org.graylog2.indexer.searches.Searches

count, count, createTermsBuilder, extractStreamId, fieldHistogram, fieldHistogram, fieldStats, fieldStats, fieldStats, histogram, histogram, scroll, search, search, search, terms, terms, terms, terms, termsHistogram, termsStats, termsStats, tookMsFromSearchResult, wrapInMultiSearch

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

MoreSearch

@Inject
public MoreSearch(StreamService streamService,
                          Indices indices,
                          IndexRangeService indexRangeService,
                          IndexSetRegistry indexSetRegistry,
                          com.codahale.metrics.MetricRegistry metricRegistry,
                          ScrollResult.Factory scrollResultFactory,
                          io.searchbox.client.JestClient jestClient,
                          Configuration configuration)

Method Detail

scrollQuery

public void scrollQuery(String queryString,
                        Set<String> streams,
                        TimeRange timeRange,
                        int batchSize,
                        MoreSearch.ScrollCallback resultCallback)
                 throws EventProcessorException

This scrolls results for the given query, streams and time range from Elasticsearch. The result is passed to the given callback in batches. (using the given batch size)

The search will continue until it is done, an error occurs or the search is stopped by setting the continueScrolling boolean to false from the MoreSearch.ScrollCallback.

TODO: Elasticsearch has a default limit of 500 concurrent scrolls. Every caller of this method should check if there is capacity to create a new scroll request. This can be done by using the ES nodes stats API. See: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-scroll.html#scroll-search-context

Parameters:

queryString - the search query string

streams - the set of streams to search in

timeRange - the time range for the search

batchSize - the number of documents to retrieve at once

resultCallback - the callback that gets executed for each batch

Throws:

EventProcessorException

loadStreams

public Set<Stream> loadStreams(Set<String> streamIds)