opensearch

package
v0.1.31 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 3, 2026 License: Apache-2.0 Imports: 21 Imported by: 0

Documentation

Index

Constants

View Source
const DefaultPITKeepAlive = time.Minute

DefaultPITKeepAlive is how long a point-in-time is held between pages. It only has to outlive the gap between one page and the next, not the whole walk: each search extends it.

View Source
const DefaultScrollKeepAlive = time.Minute
View Source
const (

	// DefaultValueLimit caps how many distinct values one lookup returns when the
	// caller does not say.
	DefaultValueLimit = 1000
)

Variables

View Source
var DefaultFieldMappingConfig = logs.FieldMappingConfig{
	Message:   []string{"message"},
	Timestamp: []string{"@timestamp"},
	Severity:  []string{"log"},
}

Functions

func ContainsRegex added in v0.1.29

func ContainsRegex(search string) string

ContainsRegex renders a substring match as the anchored regexp OpenSearch aggregations take, escaping every character its regexp grammar reserves.

Types

type Backend

type Backend struct {
	Address     string        `json:"address"`
	Username    *types.EnvVar `json:"username,omitempty"`
	Password    *types.EnvVar `json:"password,omitempty"`
	InsecureTLS bool          `json:"insecureTLS,omitempty"`
	// InspectionKey identifies the resolved connection without placing its URL
	// or credentials in metadata cache keys.
	InspectionKey string `json:"-"`
}

+kubebuilder:object:generate=true

func (*Backend) DeepCopy

func (in *Backend) DeepCopy() *Backend

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backend.

func (*Backend) DeepCopyInto

func (in *Backend) DeepCopyInto(out *Backend)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type HitsInfo

type HitsInfo struct {
	Total    TotalHitsInfo `json:"total"`
	MaxScore float64       `json:"max_score"`
	Hits     []SearchHit   `json:"hits"`
}

type OpenSearchError added in v0.1.29

type OpenSearchError struct {
	Operation     string
	StatusCode    int
	Status        string
	Type          string
	Reason        string
	Causes        []OpenSearchErrorCause
	BodyTruncated bool
}

OpenSearchError is a bounded summary of a non-success OpenSearch response.

func (*OpenSearchError) Error added in v0.1.29

func (e *OpenSearchError) Error() string

type OpenSearchErrorCause added in v0.1.29

type OpenSearchErrorCause struct {
	Type   string
	Reason string
}

type RawClientMixin

type RawClientMixin interface {
	GetRawClient() any
}

type Request

type Request struct {
	Index string `json:"index" template:"true"`
	Query string `json:"query" template:"true"`

	// Limit is how many documents to return. It is required — "0" asks for none,
	// which is what an aggregation-only search wants.
	Limit string `json:"limit,omitempty" template:"true"`

	// PIT pins the search to a point-in-time, so consecutive pages of one walk
	// read the same view of the index.
	PIT string `json:"-"`
}

+kubebuilder:object:generate=true

func (*Request) DeepCopy

func (in *Request) DeepCopy() *Request

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Request.

func (*Request) DeepCopyInto

func (in *Request) DeepCopyInto(out *Request)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Response

type Response struct {
	Took         float64        `json:"took"`
	TimedOut     bool           `json:"timed_out"`
	Hits         HitsInfo       `json:"hits"`
	ScrollID     string         `json:"_scroll_id,omitempty"`
	Aggregations map[string]any `json:"aggregations,omitempty"`
}

type Result

type Result struct {
	// Id is the unique identifier provided by the underlying system, use to link to a point in time of a log stream
	Id string `json:"id,omitempty"`
	// RFC3339 timestamp
	Time    string            `json:"timestamp,omitempty"`
	Message string            `json:"message,omitempty"`
	Labels  map[string]string `json:"labels,omitempty"`
}

type ScrollPageRequest added in v0.1.30

type ScrollPageRequest struct {
	ID        string
	KeepAlive time.Duration
}

type ScrollRequest

type ScrollRequest struct {
	Request
	KeepAlive time.Duration
}

type SearchHit

type SearchHit struct {
	Index  string         `json:"_index"`
	Type   string         `json:"_type"`
	ID     string         `json:"_id"`
	Score  float64        `json:"_score"`
	Sort   []any          `json:"sort"`
	Source map[string]any `json:"_source"`
	Fields map[string]any `json:"fields,omitempty"`
}

type Searcher

type Searcher struct {
	// contains filtered or unexported fields
}

func New

func New(ctx context.Context, backend Backend, mappingConfig *logs.FieldMappingConfig) (*Searcher, error)

func NewWithTransport added in v0.1.15

func NewWithTransport(ctx context.Context, backend Backend, mappingConfig *logs.FieldMappingConfig, base http.RoundTripper) (*Searcher, error)

NewWithTransport creates an OpenSearch client using a caller-provided HTTP transport. Connection-backed callers use this to share Basic, OAuth and mTLS behavior with the generic HTTP connection layer; direct log backends retain the legacy username/password configuration through New.

func (*Searcher) ClearScroll

func (t *Searcher) ClearScroll(ctx context.Context, scrollID string) error

ClearScroll releases a scroll context.

func (*Searcher) ClosePIT added in v0.1.29

func (t *Searcher) ClosePIT(ctx context.Context, pitID string) error

ClosePIT releases a point-in-time. A PIT holds segments open until it expires, so a walk that ends early says so rather than leaving the cluster to time it out.

func (*Searcher) DistinctValues added in v0.1.29

func (t *Searcher) DistinctValues(ctx context.Context, req ValuesRequest) (ValuesResult, error)

DistinctValues answers what values a field holds, ordered by document count. The request body is reused as the aggregation's scope, so the values reflect whatever the query already narrows to.

func (*Searcher) GetRawClient

func (t *Searcher) GetRawClient() *opensearch.Client

func (*Searcher) InspectionKey added in v0.1.29

func (t *Searcher) InspectionKey() string

func (*Searcher) OpenPIT added in v0.1.29

func (t *Searcher) OpenPIT(ctx context.Context, index string, keepAlive time.Duration) (string, error)

OpenPIT opens a point-in-time over index and returns its id.

A PIT is what makes a walk a walk rather than a series of unrelated searches: every page reads the same frozen view, so a document written or merged mid-walk cannot shift the rows under a position already handed out. Without one, search_after is stable against ties but still sees the index change.

func (*Searcher) OpenScroll added in v0.1.30

func (t *Searcher) OpenScroll(ctx context.Context, request ScrollRequest) (Response, error)

OpenScroll starts a scroll-backed snapshot read.

func (*Searcher) ParseResponse added in v0.1.29

func (t *Searcher) ParseResponse(ctx context.Context, r Response) *logs.LogResult

ParseResponse maps a raw search response to log lines, one per hit and in hit order.

It is exported so a caller needing both the mapped rows and the raw hits — their sort values for a cursor, the total for a footer — can map a response it already holds, rather than searching twice or being handed rows whose positions have been thrown away.

func (*Searcher) ScrollNext

func (t *Searcher) ScrollNext(ctx context.Context, request ScrollPageRequest) (Response, error)

ScrollNext continues a scroll-backed snapshot read.

func (*Searcher) Search

func (t *Searcher) Search(ctx context.Context, q Request) (*logs.LogResult, error)

func (*Searcher) SearchRaw added in v0.1.15

func (t *Searcher) SearchRaw(ctx context.Context, q Request) (Response, error)

SearchRaw executes the same OpenSearch request as Search but preserves the native hit, aggregation and timing envelope. Connection browsers use this to inspect arbitrary documents; log callers continue through Search's mapping.

type TotalHitsInfo

type TotalHitsInfo struct {
	Value    int64  `json:"value"`
	Relation string `json:"relation"`
}

type Value added in v0.1.29

type Value struct {
	Value string `json:"value"`
	Count int64  `json:"count"`
}

Value is one distinct value and how many documents carry it.

type ValuesRequest added in v0.1.29

type ValuesRequest struct {
	Index string
	Field string
	// Search keeps only the values containing it, matched as a substring.
	Search string
	Limit  int
	Body   map[string]any

	// Nested names the `nested` field Field lives inside, and Where pins the
	// entry of it the values are read from — the key of a key/value tag list.
	//
	// Both are required for a nested field to answer at all: its entries are
	// indexed as separate documents, so an aggregation that does not descend into
	// them returns no buckets, and one that descends without pinning the entry
	// returns every tag's values mixed together.
	Nested string
	Where  map[string]string
}

ValuesRequest asks what a field holds. Body scopes the question to the documents a query already narrows to; nil asks the whole index.

type ValuesResult added in v0.1.29

type ValuesResult struct {
	Values []Value `json:"values"`
	Total  int     `json:"total"`
}

ValuesResult carries the values the terms aggregation returned and how many distinct ones exist behind them, which is what tells an author the list is a window rather than the whole set.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL