elastic

type Agg struct {
	DateHistogram *DateHistogram `json:"date_histogram,omitempty"`
	Terms         *TermsAgg      `json:"terms,omitempty"`
	Aggs          map[string]Agg `json:"aggs,omitempty"`
}

type BoolQuery struct {
	Filter  []Clause `json:"filter,omitempty"`
	MustNot []Clause `json:"must_not,omitempty"`
}

type Clause struct {
	Range map[string]RangeSpec `json:"range,omitempty"`
	Term  map[string]string    `json:"term,omitempty"`
	Terms map[string][]string  `json:"terms,omitempty"`
}

type Client interface {
	Send(ctx context.Context, method, path string, q url.Values, body []byte) (egress.Response, error)
}

type CountBody struct {
	Query Query `json:"query"`
}

type DateHistogram struct {
	Field         string `json:"field"`
	FixedInterval string `json:"fixed_interval"`
	Offset        string `json:"offset,omitempty"`
	MinDocCount   int    `json:"min_doc_count"`
}

type FieldValues struct {
	Field  string   `json:"f"`
	Values []string `json:"v"`
}

type Filter struct {
	In    []FieldValues `json:"in,omitempty"`
	NotIn []FieldValues `json:"not_in,omitempty"`
}

type IndexPrivileges struct {
	Names      []string `json:"names"`
	Privileges []string `json:"privileges"`
}

type Info struct {
	Flavour string
	Version string
	// Write lists the write or manage privileges the credentials hold
	// (Elasticsearch), or the roles not known to be read-only
	// (OpenSearch). Empty on a read-only key.
	Write []string
	// Verified is set when the privileges could be read.
	Verified bool
}

type Options struct {
	Name string
	// Kind is KindElastic (default) or KindOpenSearch: the flavour Check
	// requires of the backend.
	Kind   string
	Client Client
	Parser *parse.Parser
	// Indices are the indices, aliases, data streams or trailing-'*'
	// patterns read (validated: egress.ValidIndex).
	Indices []string
	// Selector is the profile's scope: field = value terms ANDed into
	// every query (optional: the indices already scope the source).
	Selector map[string]string
	// TrustedFields are keyword fields shown (after the detectors),
	// selectable and countable; every other field is dropped.
	TrustedFields []string
	// TimeField is the record time (default @timestamp); MessageField the
	// text parsed as the line (default message).
	TimeField    string
	MessageField string
	// TieBreaker is a keyword field unique per document (an event id):
	// pages then resume exactly after the last hit. Without it, a page
	// resumes at the last hit's timestamp and skips the hits it returned;
	// more than Size documents at one timestamp is then an error.
	TieBreaker string
	// ReadOnlyRoles are OpenSearch roles the human vouches grant no
	// write or manage permission (besides the built-in readall roles).
	ReadOnlyRoles []string
	// InFlight overrides InFlight; Size the hits per page (default and
	// cap MaxSize).
	InFlight int
	Size     int
	Now      func() time.Time
}

type PrivilegesBody struct {
	Cluster []string          `json:"cluster"`
	Index   []IndexPrivileges `json:"index"`
}

type Query struct {
	Bool BoolQuery `json:"bool"`
}

type RangeSpec struct {
	GTE    string `json:"gte"`
	LT     string `json:"lt"`
	Format string `json:"format"`
}

type SearchBody struct {
	Size           int                   `json:"size"`
	Timeout        string                `json:"timeout"`
	TrackTotalHits bool                  `json:"track_total_hits"`
	Source         bool                  `json:"_source"`
	Fields         []string              `json:"fields,omitempty"`
	Query          Query                 `json:"query"`
	Sort           []map[string]SortSpec `json:"sort,omitempty"`
	SearchAfter    []any                 `json:"search_after,omitempty"`
	Aggs           map[string]Agg        `json:"aggs,omitempty"`
}

type SortSpec struct {
	Order        string `json:"order"`
	NumericType  string `json:"numeric_type,omitempty"`
	UnmappedType string `json:"unmapped_type,omitempty"`
}

type Source struct {
	// contains filtered or unexported fields
}

type TermsAgg struct {
	Field   string  `json:"field"`
	Size    int     `json:"size"`
	Missing *string `json:"missing,omitempty"`
}