Module: Elasticsearch::API::TextStructure::Actions
- Defined in:
- lib/elasticsearch/api/actions/text_structure/find_structure.rb,
lib/elasticsearch/api/actions/text_structure/test_grok_pattern.rb,
lib/elasticsearch/api/actions/text_structure/find_field_structure.rb,
lib/elasticsearch/api/actions/text_structure/find_message_structure.rb
Instance Method Summary collapse
-
#find_field_structure(arguments = {}) ⇒ Object
Find the structure of a text field.
-
#find_message_structure(arguments = {}) ⇒ Object
Find the structure of text messages.
-
#find_structure(arguments = {}) ⇒ Object
Find the structure of a text file.
-
#test_grok_pattern(arguments = {}) ⇒ Object
Test a Grok pattern.
Instance Method Details
#find_field_structure(arguments = {}) ⇒ Object
Find the structure of a text field. Find the structure of a text field in an Elasticsearch index. This API provides a starting point for extracting further information from log messages already ingested into Elasticsearch. For example, if you have ingested data into a very simple index that has just @timestamp and message fields, you can use this API to see what common structure exists in the message field. The response from the API contains:
-
Sample messages.
-
Statistics that reveal the most common values for all fields detected within the text and basic numeric statistics for numeric fields.
-
Information about the structure of the text, which is useful when you write ingest configurations to index it or similarly formatted text.
-
Appropriate mappings for an Elasticsearch index, which you could use to ingest the text.
All this information can be calculated by the structure finder with no guidance. However, you can optionally override some of the decisions about the text structure by specifying one or more query parameters. If the structure finder produces unexpected results, specify the explain
query parameter and an explanation will appear in the response. It helps determine why the returned structure was chosen.
108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 |
# File 'lib/elasticsearch/api/actions/text_structure/find_field_structure.rb', line 108 def find_field_structure(arguments = {}) request_opts = { endpoint: arguments[:endpoint] || 'text_structure.find_field_structure' } arguments = arguments.clone headers = arguments.delete(:headers) || {} body = nil method = Elasticsearch::API::HTTP_GET path = '_text_structure/find_field_structure' params = Utils.process_params(arguments) Elasticsearch::API::Response.new( perform_request(method, path, params, body, headers, request_opts) ) end |
#find_message_structure(arguments = {}) ⇒ Object
Find the structure of text messages. Find the structure of a list of text messages. The messages must contain data that is suitable to be ingested into Elasticsearch. This API provides a starting point for ingesting data into Elasticsearch in a format that is suitable for subsequent use with other Elastic Stack functionality. Use this API rather than the find text structure API if your input text has already been split up into separate messages by some other process. The response from the API contains:
-
Sample messages.
-
Statistics that reveal the most common values for all fields detected within the text and basic numeric statistics for numeric fields.
-
Information about the structure of the text, which is useful when you write ingest configurations to index it or similarly formatted text.
Appropriate mappings for an Elasticsearch index, which you could use to ingest the text. All this information can be calculated by the structure finder with no guidance. However, you can optionally override some of the decisions about the text structure by specifying one or more query parameters. If the structure finder produces unexpected results, specify the explain
query parameter and an explanation will appear in the response. It helps determine why the returned structure was chosen.
105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 |
# File 'lib/elasticsearch/api/actions/text_structure/find_message_structure.rb', line 105 def (arguments = {}) request_opts = { endpoint: arguments[:endpoint] || 'text_structure.find_message_structure' } raise ArgumentError, "Required argument 'body' missing" unless arguments[:body] arguments = arguments.clone headers = arguments.delete(:headers) || {} body = arguments.delete(:body) method = Elasticsearch::API::HTTP_POST path = '_text_structure/find_message_structure' params = Utils.process_params(arguments) Elasticsearch::API::Response.new( perform_request(method, path, params, body, headers, request_opts) ) end |
#find_structure(arguments = {}) ⇒ Object
Find the structure of a text file. The text file must contain data that is suitable to be ingested into Elasticsearch. This API provides a starting point for ingesting data into Elasticsearch in a format that is suitable for subsequent use with other Elastic Stack functionality. Unlike other Elasticsearch endpoints, the data that is posted to this endpoint does not need to be UTF-8 encoded and in JSON format. It must, however, be text; binary text formats are not currently supported. The size is limited to the Elasticsearch HTTP receive buffer size, which defaults to 100 Mb. The response from the API contains:
-
A couple of messages from the beginning of the text.
-
Statistics that reveal the most common values for all fields detected within the text and basic numeric statistics for numeric fields.
-
Information about the structure of the text, which is useful when you write ingest configurations to index it or similarly formatted text.
-
Appropriate mappings for an Elasticsearch index, which you could use to ingest the text.
All this information can be calculated by the structure finder with no guidance. However, you can optionally override some of the decisions about the text structure by specifying one or more query parameters.
119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 |
# File 'lib/elasticsearch/api/actions/text_structure/find_structure.rb', line 119 def find_structure(arguments = {}) request_opts = { endpoint: arguments[:endpoint] || 'text_structure.find_structure' } raise ArgumentError, "Required argument 'body' missing" unless arguments[:body] arguments = arguments.clone headers = arguments.delete(:headers) || {} body = arguments.delete(:body) method = Elasticsearch::API::HTTP_POST path = '_text_structure/find_structure' params = Utils.process_params(arguments) payload = if body.is_a? Array Elasticsearch::API::Utils.bulkify(body) else body end headers.merge!({ 'Content-Type' => 'application/vnd.elasticsearch+x-ndjson; compatible-with=9' }) Elasticsearch::API::Response.new( perform_request(method, path, params, payload, headers, request_opts) ) end |
#test_grok_pattern(arguments = {}) ⇒ Object
Test a Grok pattern. Test a Grok pattern on one or more lines of text. The API indicates whether the lines match the pattern together with the offsets and lengths of the matched substrings.
37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 |
# File 'lib/elasticsearch/api/actions/text_structure/test_grok_pattern.rb', line 37 def test_grok_pattern(arguments = {}) request_opts = { endpoint: arguments[:endpoint] || 'text_structure.test_grok_pattern' } raise ArgumentError, "Required argument 'body' missing" unless arguments[:body] arguments = arguments.clone headers = arguments.delete(:headers) || {} body = arguments.delete(:body) method = Elasticsearch::API::HTTP_POST path = '_text_structure/test_grok_pattern' params = Utils.process_params(arguments) Elasticsearch::API::Response.new( perform_request(method, path, params, body, headers, request_opts) ) end |