Python SpikeRule.add_terms_data方法代码示例

本文整理汇总了Python中elastalert.ruletypes.SpikeRule.add_terms_data方法的典型用法代码示例。如果您正苦于以下问题：Python SpikeRule.add_terms_data方法的具体用法？Python SpikeRule.add_terms_data怎么用？Python SpikeRule.add_terms_data使用的例子？那么恭喜您, 这里精选的方法代码示例或许可以为您提供帮助。您也可以进一步了解该方法所在类elastalert.ruletypes.SpikeRule的用法示例。

在下文中一共展示了SpikeRule.add_terms_data方法的3个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于系统推荐出更棒的Python代码示例。

示例1: test_spike_terms

# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_terms_data [as 别名]
def test_spike_terms():
    rules = {
        "threshold_ref": 5,
        "spike_height": 2,
        "timeframe": datetime.timedelta(minutes=10),
        "spike_type": "both",
        "use_count_query": False,
        "timestamp_field": "ts",
        "query_key": "username",
        "use_term_query": True,
    }
    terms1 = {ts_to_dt("2014-01-01T00:01:00Z"): [{"key": "userA", "doc_count": 10}, {"key": "userB", "doc_count": 5}]}
    terms2 = {ts_to_dt("2014-01-01T00:10:00Z"): [{"key": "userA", "doc_count": 22}, {"key": "userB", "doc_count": 5}]}
    terms3 = {ts_to_dt("2014-01-01T00:25:00Z"): [{"key": "userA", "doc_count": 25}, {"key": "userB", "doc_count": 27}]}
    terms4 = {
        ts_to_dt("2014-01-01T00:27:00Z"): [
            {"key": "userA", "doc_count": 10},
            {"key": "userB", "doc_count": 12},
            {"key": "userC", "doc_count": 100},
        ]
    }
    terms5 = {
        ts_to_dt("2014-01-01T00:30:00Z"): [{"key": "userD", "doc_count": 100}, {"key": "userC", "doc_count": 100}]
    }

    rule = SpikeRule(rules)

    # Initial input
    rule.add_terms_data(terms1)
    assert len(rule.matches) == 0

    # No spike for UserA because windows not filled
    rule.add_terms_data(terms2)
    assert len(rule.matches) == 0

    # Spike for userB only
    rule.add_terms_data(terms3)
    assert len(rule.matches) == 1
    assert rule.matches[0].get("username") == "userB"

    # Test no alert for new user over threshold
    rules.pop("threshold_ref")
    rules["threshold_cur"] = 50
    rule = SpikeRule(rules)
    rule.add_terms_data(terms1)
    rule.add_terms_data(terms2)
    rule.add_terms_data(terms3)
    rule.add_terms_data(terms4)
    assert len(rule.matches) == 0

    # Test alert_on_new_data
    rules["alert_on_new_data"] = True
    rule = SpikeRule(rules)
    rule.add_terms_data(terms1)
    rule.add_terms_data(terms2)
    rule.add_terms_data(terms3)
    rule.add_terms_data(terms4)
    assert len(rule.matches) == 1

    # Test that another alert doesn't fire immediately for userC but it does for userD
    rule.matches = []
    rule.add_terms_data(terms5)
    assert len(rule.matches) == 1
    assert rule.matches[0]["username"] == "userD"

开发者ID:mesozoic，项目名称:elastalert，代码行数:66，代码来源:rules_test.py

示例2: test_spike_terms

# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_terms_data [as 别名]
def test_spike_terms():
    rules = {'threshold_ref': 5,
             'spike_height': 2,
             'timeframe': datetime.timedelta(minutes=10),
             'spike_type': 'both',
             'use_count_query': False,
             'timestamp_field': 'ts',
             'query_key': 'username',
             'use_term_query': True}
    terms1 = {ts_to_dt('2014-01-01T00:01:00Z'): [{'key': 'userA', 'doc_count': 10},
                                                 {'key': 'userB', 'doc_count': 5}]}
    terms2 = {ts_to_dt('2014-01-01T00:10:00Z'): [{'key': 'userA', 'doc_count': 22},
                                                 {'key': 'userB', 'doc_count': 5}]}
    terms3 = {ts_to_dt('2014-01-01T00:25:00Z'): [{'key': 'userA', 'doc_count': 25},
                                                 {'key': 'userB', 'doc_count': 27}]}
    terms4 = {ts_to_dt('2014-01-01T00:27:00Z'): [{'key': 'userA', 'doc_count': 10},
                                                 {'key': 'userB', 'doc_count': 12},
                                                 {'key': 'userC', 'doc_count': 100}]}
    terms5 = {ts_to_dt('2014-01-01T00:30:00Z'): [{'key': 'userD', 'doc_count': 100},
                                                 {'key': 'userC', 'doc_count': 100}]}

    rule = SpikeRule(rules)

    # Initial input
    rule.add_terms_data(terms1)
    assert len(rule.matches) == 0

    # No spike for UserA because windows not filled
    rule.add_terms_data(terms2)
    assert len(rule.matches) == 0

    # Spike for userB only
    rule.add_terms_data(terms3)
    assert len(rule.matches) == 1
    assert rule.matches[0].get('username') == 'userB'

    # Test no alert for new user over threshold
    rules.pop('threshold_ref')
    rules['threshold_cur'] = 50
    rule = SpikeRule(rules)
    rule.add_terms_data(terms1)
    rule.add_terms_data(terms2)
    rule.add_terms_data(terms3)
    rule.add_terms_data(terms4)
    assert len(rule.matches) == 0

    # Test alert_on_new_data
    rules['alert_on_new_data'] = True
    rule = SpikeRule(rules)
    rule.add_terms_data(terms1)
    rule.add_terms_data(terms2)
    rule.add_terms_data(terms3)
    rule.add_terms_data(terms4)
    assert len(rule.matches) == 1

    # Test that another alert doesn't fire immediately for userC but it does for userD
    rule.matches = []
    rule.add_terms_data(terms5)
    assert len(rule.matches) == 1
    assert rule.matches[0]['username'] == 'userD'

开发者ID:danielstorytel，项目名称:elastalert，代码行数:62，代码来源:rules_test.py

示例3: test_spike_terms_query_key_alert_on_new_data

# 需要导入模块: from elastalert.ruletypes import SpikeRule [as 别名]
# 或者: from elastalert.ruletypes.SpikeRule import add_terms_data [as 别名]
def test_spike_terms_query_key_alert_on_new_data():
    rules = {'spike_height': 1.5,
             'timeframe': datetime.timedelta(minutes=10),
             'spike_type': 'both',
             'use_count_query': False,
             'timestamp_field': 'ts',
             'query_key': 'username',
             'use_term_query': True,
             'alert_on_new_data': True}

    terms1 = {ts_to_dt('2014-01-01T00:01:00Z'): [{'key': 'userA', 'doc_count': 10}]}
    terms2 = {ts_to_dt('2014-01-01T00:06:00Z'): [{'key': 'userA', 'doc_count': 10}]}
    terms3 = {ts_to_dt('2014-01-01T00:11:00Z'): [{'key': 'userA', 'doc_count': 10}]}
    terms4 = {ts_to_dt('2014-01-01T00:21:00Z'): [{'key': 'userA', 'doc_count': 20}]}
    terms5 = {ts_to_dt('2014-01-01T00:26:00Z'): [{'key': 'userA', 'doc_count': 20}]}
    terms6 = {ts_to_dt('2014-01-01T00:31:00Z'): [{'key': 'userA', 'doc_count': 20}]}
    terms7 = {ts_to_dt('2014-01-01T00:36:00Z'): [{'key': 'userA', 'doc_count': 20}]}
    terms8 = {ts_to_dt('2014-01-01T00:41:00Z'): [{'key': 'userA', 'doc_count': 20}]}

    rule = SpikeRule(rules)

    # Initial input
    rule.add_terms_data(terms1)
    assert len(rule.matches) == 0

    # No spike for UserA because windows not filled
    rule.add_terms_data(terms2)
    assert len(rule.matches) == 0

    rule.add_terms_data(terms3)
    assert len(rule.matches) == 0

    rule.add_terms_data(terms4)
    assert len(rule.matches) == 0

    # Spike
    rule.add_terms_data(terms5)
    assert len(rule.matches) == 1

    rule.matches[:] = []

    # There will be no more spikes since all terms have the same doc_count
    rule.add_terms_data(terms6)
    assert len(rule.matches) == 0

    rule.add_terms_data(terms7)
    assert len(rule.matches) == 0

    rule.add_terms_data(terms8)
    assert len(rule.matches) == 0

开发者ID:dariagolub，项目名称:elastalert，代码行数:52，代码来源:rules_test.py

注：本文中的elastalert.ruletypes.SpikeRule.add_terms_data方法示例由纯净天空整理自Github/MSDocs等开源代码及文档管理平台，相关代码片段筛选自各路编程大神贡献的开源项目，源码版权归原作者所有，传播和使用请参考对应项目的License；未经允许，请勿转载。