本文整理汇总了Python中elastalert.ruletypes.SpikeRule.add_data方法的典型用法代码示例。如果您正苦于以下问题：Python SpikeRule.add_data方法的具体用法？Python SpikeRule.add_data怎么用？Python SpikeRule.add_data使用的例子？那么恭喜您, 这里精选的方法代码示例或许可以为您提供帮助。您也可以进一步了解该方法所在类elastalert.ruletypes.SpikeRule的用法示例。
在下文中一共展示了SpikeRule.add_data方法的6个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于系统推荐出更棒的Python代码示例。
示例1: test_spike_deep_key
# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_data [as 别名]
def test_spike_deep_key():
rules = {'threshold_ref': 10,
'spike_height': 2,
'timeframe': datetime.timedelta(seconds=10),
'spike_type': 'both',
'timestamp_field': '@timestamp',
'query_key': 'foo.bar.baz'}
rule = SpikeRule(rules)
rule.add_data([{'@timestamp': ts_to_dt('2015'), 'foo': {'bar': {'baz': 'LOL'}}}])
assert 'LOL' in rule.cur_windows示例2: test_spike_deep_key
# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_data [as 别名]
def test_spike_deep_key():
rules = {
"threshold_ref": 10,
"spike_height": 2,
"timeframe": datetime.timedelta(seconds=10),
"spike_type": "both",
"timestamp_field": "@timestamp",
"query_key": "foo.bar.baz",
}
rule = SpikeRule(rules)
rule.add_data([{"@timestamp": ts_to_dt("2015"), "foo": {"bar": {"baz": "LOL"}}}])
assert "LOL" in rule.cur_windows示例3: test_spike_query_key
# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_data [as 别名]
def test_spike_query_key():
events = hits(100, timestamp_field='ts', username='qlo')
# Constant rate, doesn't match
rules = {'threshold_ref': 10,
'spike_height': 2,
'timeframe': datetime.timedelta(seconds=10),
'spike_type': 'both',
'use_count_query': False,
'timestamp_field': 'ts',
'query_key': 'username'}
rule = SpikeRule(rules)
rule.add_data(events)
assert len(rule.matches) == 0
# Double the rate of events, but with a different usename
events_bob = hits(100, timestamp_field='ts', username='bob')
events2 = events[:50]
for num in range(50, 99):
events2.append(events_bob[num])
events2.append(events[num])
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 0
# Double the rate of events, with the same username
events2 = events[:50]
for num in range(50, 99):
events2.append(events_bob[num])
events2.append(events[num])
events2.append(events[num])
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 1示例4: test_spike_query_key
# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_data [as 别名]
def test_spike_query_key():
events = hits(100, timestamp_field="ts", username="qlo")
# Constant rate, doesn't match
rules = {
"threshold_ref": 10,
"spike_height": 2,
"timeframe": datetime.timedelta(seconds=10),
"spike_type": "both",
"use_count_query": False,
"timestamp_field": "ts",
"query_key": "username",
}
rule = SpikeRule(rules)
rule.add_data(events)
assert len(rule.matches) == 0
# Double the rate of events, but with a different usename
events_bob = hits(100, timestamp_field="ts", username="bob")
events2 = events[:50]
for num in range(50, 99):
events2.append(events_bob[num])
events2.append(events[num])
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 0
# Double the rate of events, with the same username
events2 = events[:50]
for num in range(50, 99):
events2.append(events_bob[num])
events2.append(events[num])
events2.append(events[num])
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 1示例5: test_spike
# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_data [as 别名]
def test_spike():
# Events are 1 per second
events = hits(100, timestamp_field='ts')
# Constant rate, doesn't match
rules = {'threshold_ref': 10,
'spike_height': 2,
'timeframe': datetime.timedelta(seconds=10),
'spike_type': 'both',
'use_count_query': False,
'timestamp_field': 'ts'}
rule = SpikeRule(rules)
rule.add_data(events)
assert len(rule.matches) == 0
# Double the rate of events after [50:]
events2 = events[:50]
for event in events[50:]:
events2.append(event)
events2.append({'ts': event['ts'] + datetime.timedelta(milliseconds=1)})
rules['spike_type'] = 'up'
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 1
# Doesn't match
rules['spike_height'] = 3
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 0
# Downward spike
events = events[:50] + events[75:]
rules['spike_type'] = 'down'
rule = SpikeRule(rules)
rule.add_data(events)
assert len(rule.matches) == 1
# Doesn't meet threshold_ref
# When ref hits 11, cur is only 20
rules['spike_height'] = 2
rules['threshold_ref'] = 11
rules['spike_type'] = 'up'
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 0
# Doesn't meet threshold_cur
# Maximum rate of events is 20 per 10 seconds
rules['threshold_ref'] = 10
rules['threshold_cur'] = 30
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 0
# Alert on new data
# (At least 25 events occur before 30 seconds has elapsed)
rules.pop('threshold_ref')
rules['timeframe'] = datetime.timedelta(seconds=30)
rules['threshold_cur'] = 25
rules['spike_height'] = 2
rules['alert_on_new_data'] = True
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 1示例6: test_spike
# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_data [as 别名]
def test_spike():
# Events are 1 per second
events = hits(100, timestamp_field="ts")
# Constant rate, doesn't match
rules = {
"threshold_ref": 10,
"spike_height": 2,
"timeframe": datetime.timedelta(seconds=10),
"spike_type": "both",
"use_count_query": False,
"timestamp_field": "ts",
}
rule = SpikeRule(rules)
rule.add_data(events)
assert len(rule.matches) == 0
# Double the rate of events after [50:]
events2 = events[:50]
for event in events[50:]:
events2.append(event)
events2.append({"ts": event["ts"] + datetime.timedelta(milliseconds=1)})
rules["spike_type"] = "up"
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 1
# Doesn't match
rules["spike_height"] = 3
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 0
# Downward spike
events = events[:50] + events[75:]
rules["spike_type"] = "down"
rule = SpikeRule(rules)
rule.add_data(events)
assert len(rule.matches) == 1
# Doesn't meet threshold_ref
# When ref hits 11, cur is only 20
rules["spike_height"] = 2
rules["threshold_ref"] = 11
rules["spike_type"] = "up"
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 0
# Doesn't meet threshold_cur
# Maximum rate of events is 20 per 10 seconds
rules["threshold_ref"] = 10
rules["threshold_cur"] = 30
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 0
# Alert on new data
# (At least 25 events occur before 30 seconds has elapsed)
rules.pop("threshold_ref")
rules["timeframe"] = datetime.timedelta(seconds=30)
rules["threshold_cur"] = 25
rules["spike_height"] = 2
rules["alert_on_new_data"] = True
rule = SpikeRule(rules)
rule.add_data(events2)
assert len(rule.matches) == 1