本文整理汇总了Python中elastalert.ruletypes.NewTermsRule.add_terms_data方法的典型用法代码示例。如果您正苦于以下问题：Python NewTermsRule.add_terms_data方法的具体用法？Python NewTermsRule.add_terms_data怎么用？Python NewTermsRule.add_terms_data使用的例子？那么恭喜您, 这里精选的方法代码示例或许可以为您提供帮助。您也可以进一步了解该方法所在类elastalert.ruletypes.NewTermsRule的用法示例。
在下文中一共展示了NewTermsRule.add_terms_data方法的2个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于系统推荐出更棒的Python代码示例。
示例1: test_new_term_with_terms
# 需要导入模块: from elastalert.ruletypes import NewTermsRule [as 别名]
# 或者: from elastalert.ruletypes.NewTermsRule import add_terms_data [as 别名]
def test_new_term_with_terms():
rules = {'fields': ['a'],
'timestamp_field': '@timestamp',
'es_host': 'example.com', 'es_port': 10, 'index': 'logstash', 'query_key': 'a'}
mock_res = {'aggregations': {'filtered': {'values': {'buckets': [{'key': 'key1', 'doc_count': 1},
{'key': 'key2', 'doc_count': 5}]}}}}
with mock.patch('elastalert.ruletypes.Elasticsearch') as mock_es:
mock_es.return_value = mock.Mock()
mock_es.return_value.search.return_value = mock_res
rule = NewTermsRule(rules)
assert rule.es.search.call_count == 1
# Key1 and key2 shouldn't cause a match
terms = {ts_now(): [{'key': 'key1', 'doc_count': 1},
{'key': 'key2', 'doc_count': 1}]}
rule.add_terms_data(terms)
assert rule.matches == []
# Key3 causes an alert for field a
terms = {ts_now(): [{'key': 'key3', 'doc_count': 1}]}
rule.add_terms_data(terms)
assert len(rule.matches) == 1
assert rule.matches[0]['new_field'] == 'a'
assert rule.matches[0]['a'] == 'key3'
rule.matches = []
# Key3 doesn't cause another alert
terms = {ts_now(): [{'key': 'key3', 'doc_count': 1}]}
rule.add_terms_data(terms)
assert rule.matches == []示例2: test_new_term_with_terms
# 需要导入模块: from elastalert.ruletypes import NewTermsRule [as 别名]
# 或者: from elastalert.ruletypes.NewTermsRule import add_terms_data [as 别名]
def test_new_term_with_terms():
rules = {'fields': ['a'],
'timestamp_field': '@timestamp',
'es_host': 'example.com', 'es_port': 10, 'index': 'logstash', 'query_key': 'a',
'window_step_size': {'days': 2}}
mock_res = {'aggregations': {'filtered': {'values': {'buckets': [{'key': 'key1', 'doc_count': 1},
{'key': 'key2', 'doc_count': 5}]}}}}
with mock.patch('elastalert.ruletypes.elasticsearch_client') as mock_es:
mock_es.return_value = mock.Mock()
mock_es.return_value.search.return_value = mock_res
mock_es.return_value.info.return_value = {'version': {'number': '2.x.x'}}
rule = NewTermsRule(rules)
# Only 15 queries because of custom step size
assert rule.es.search.call_count == 15
# Key1 and key2 shouldn't cause a match
terms = {ts_now(): [{'key': 'key1', 'doc_count': 1},
{'key': 'key2', 'doc_count': 1}]}
rule.add_terms_data(terms)
assert rule.matches == []
# Key3 causes an alert for field a
terms = {ts_now(): [{'key': 'key3', 'doc_count': 1}]}
rule.add_terms_data(terms)
assert len(rule.matches) == 1
assert rule.matches[0]['new_field'] == 'a'
assert rule.matches[0]['a'] == 'key3'
rule.matches = []
# Key3 doesn't cause another alert
terms = {ts_now(): [{'key': 'key3', 'doc_count': 1}]}
rule.add_terms_data(terms)
assert rule.matches == []