Help us shape the future of Go! Take the 2026 Go Developer Survey

opensearch

package
v0.1.63 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 25, 2026 License: Apache-2.0 Imports: 21 Imported by: 1

Documentation

Index

Constants

View Source
const DefaultPITKeepAlive = time.Minute

DefaultPITKeepAlive is how long a point-in-time is held between pages. It only has to outlive the gap between one page and the next, not the whole walk: each search extends it.

View Source
const DefaultScrollKeepAlive = time.Minute
View Source
const (

	// DefaultValueLimit caps how many distinct values one lookup returns when the
	// caller does not say.
	DefaultValueLimit = 1000
)

Variables

View Source
var DefaultFieldMappingConfig = logs.FieldMappingConfig{
	Message:   []string{"message"},
	Timestamp: []string{"@timestamp"},
	Severity:  []string{"log"},
}

Functions

func ContainsRegex added in v0.1.29

func ContainsRegex(search string) string

ContainsRegex renders a substring match as the anchored regexp OpenSearch aggregations take, escaping every character its regexp grammar reserves.

Types

type Backend

type Backend struct {
	Address     string        `json:"address"`
	Username    *types.EnvVar `json:"username,omitempty"`
	Password    *types.EnvVar `json:"password,omitempty"`
	InsecureTLS bool          `json:"insecureTLS,omitempty"`
	// InspectionKey identifies the resolved connection without placing its URL
	// or credentials in metadata cache keys.
	InspectionKey string `json:"-"`
}

+kubebuilder:object:generate=true

func (*Backend) DeepCopy

func (in *Backend) DeepCopy() *Backend

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backend.

func (*Backend) DeepCopyInto

func (in *Backend) DeepCopyInto(out *Backend)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type HitsInfo

type HitsInfo struct {
	Total    TotalHitsInfo `json:"total"`
	MaxScore float64       `json:"max_score"`
	Hits     []SearchHit   `json:"hits"`
}

type OpenSearchError added in v0.1.29

type OpenSearchError struct {
	Operation     string
	StatusCode    int
	Status        string
	Type          string
	Reason        string
	Causes        []OpenSearchErrorCause
	BodyTruncated bool
}

OpenSearchError is a bounded summary of a non-success OpenSearch response.

func (*OpenSearchError) Error added in v0.1.29

func (e *OpenSearchError) Error() string

type OpenSearchErrorCause added in v0.1.29

type OpenSearchErrorCause struct {
	Type   string
	Reason string
}

type RawClientMixin

type RawClientMixin interface {
	GetRawClient() any
}

type Request

type Request struct {
	Index string `json:"index" template:"true"`
	Query string `json:"query" template:"true"`

	// Limit is how many documents to return. It is required — "0" asks for none,
	// which is what an aggregation-only search wants.
	Limit string `json:"limit,omitempty" template:"true"`

	// PIT pins the search to a point-in-time, so consecutive pages of one walk
	// read the same view of the index.
	PIT string `json:"-"`
}

+kubebuilder:object:generate=true

func (*Request) DeepCopy

func (in *Request) DeepCopy() *Request

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Request.

func (*Request) DeepCopyInto

func (in *Request) DeepCopyInto(out *Request)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Response

type Response struct {
	Took         float64        `json:"took"`
	TimedOut     bool           `json:"timed_out"`
	Hits         HitsInfo       `json:"hits"`
	ScrollID     string         `json:"_scroll_id,omitempty"`
	Aggregations map[string]any `json:"aggregations,omitempty"`
}

type Result

type Result struct {
	// Id is the unique identifier provided by the underlying system, use to link to a point in time of a log stream
	Id string `json:"id,omitempty"`
	// RFC3339 timestamp
	Time    string            `json:"timestamp,omitempty"`
	Message string            `json:"message,omitempty"`
	Labels  map[string]string `json:"labels,omitempty"`
}

type ScrollPageRequest added in v0.1.30

type ScrollPageRequest struct {
	ID        string
	KeepAlive time.Duration
}

type ScrollRequest

type ScrollRequest struct {
	Request
	KeepAlive time.Duration
}

type SearchHit

type SearchHit struct {
	Index  string         `json:"_index"`
	Type   string         `json:"_type"`
	ID     string         `json:"_id"`
	Score  float64        `json:"_score"`
	Sort   []any          `json:"sort"`
	Source map[string]any `json:"_source"`
	Fields map[string]any `json:"fields,omitempty"`
}

type Searcher

type Searcher struct {
	// contains filtered or unexported fields
}

func New

func New(ctx context.Context, backend Backend, mappingConfig *logs.FieldMappingConfig) (*Searcher, error)

func NewWithTransport added in v0.1.15

func NewWithTransport(ctx context.Context, backend Backend, mappingConfig *logs.FieldMappingConfig, base http.RoundTripper) (*Searcher, error)

NewWithTransport creates an OpenSearch client using a caller-provided HTTP transport. Connection-backed callers use this to share Basic, OAuth and mTLS behavior with the generic HTTP connection layer; direct log backends retain the legacy username/password configuration through New.

func (*Searcher) ClearScroll

func (t *Searcher) ClearScroll(ctx context.Context, scrollID string) error

ClearScroll releases a scroll context.

func (*Searcher) ClosePIT added in v0.1.29

func (t *Searcher) ClosePIT(ctx context.Context, pitID string) error

ClosePIT releases a point-in-time. A PIT holds segments open until it expires, so a walk that ends early says so rather than leaving the cluster to time it out.

func (*Searcher) DistinctValues added in v0.1.29

func (t *Searcher) DistinctValues(ctx context.Context, req ValuesRequest) (ValuesResult, error)

DistinctValues answers what values a field holds, ordered by document count. The request body is reused as the aggregation's scope, so the values reflect whatever the query already narrows to.

func (*Searcher) GetRawClient

func (t *Searcher) GetRawClient() *opensearch.Client

func (*Searcher) InspectionKey added in v0.1.29

func (t *Searcher) InspectionKey() string

func (*Searcher) OpenPIT added in v0.1.29

func (t *Searcher) OpenPIT(ctx context.Context, index string, keepAlive time.Duration) (string, error)

OpenPIT opens a point-in-time over index and returns its id.

A PIT is what makes a walk a walk rather than a series of unrelated searches: every page reads the same frozen view, so a document written or merged mid-walk cannot shift the rows under a position already handed out. Without one, search_after is stable against ties but still sees the index change.

func (*Searcher) OpenScroll added in v0.1.30

func (t *Searcher) OpenScroll(ctx context.Context, request ScrollRequest) (Response, error)

OpenScroll starts a scroll-backed snapshot read.

func (*Searcher) ParseResponse added in v0.1.29

func (t *Searcher) ParseResponse(ctx context.Context, r Response) *logs.LogResult

ParseResponse maps a raw search response to log lines, one per hit and in hit order.

It is exported so a caller needing both the mapped rows and the raw hits — their sort values for a cursor, the total for a footer — can map a response it already holds, rather than searching twice or being handed rows whose positions have been thrown away.

func (*Searcher) ScrollNext

func (t *Searcher) ScrollNext(ctx context.Context, request ScrollPageRequest) (Response, error)

ScrollNext continues a scroll-backed snapshot read.

func (*Searcher) Search

func (t *Searcher) Search(ctx context.Context, q Request) (*logs.LogResult, error)

func (*Searcher) SearchRaw added in v0.1.15

func (t *Searcher) SearchRaw(ctx context.Context, q Request) (Response, error)

SearchRaw executes the same OpenSearch request as Search but preserves the native hit, aggregation and timing envelope. Connection browsers use this to inspect arbitrary documents; log callers continue through Search's mapping.

type TotalHitsInfo

type TotalHitsInfo struct {
	Value    int64  `json:"value"`
	Relation string `json:"relation"`
}

type Value added in v0.1.29

type Value struct {
	Value string `json:"value"`
	Count int64  `json:"count"`
}

Value is one distinct value and how many documents carry it.

type ValuesRequest added in v0.1.29

type ValuesRequest struct {
	Index string
	Field string
	// Search keeps only the values containing it, matched as a substring.
	Search string
	Limit  int
	Body   map[string]any

	// Nested names the `nested` field Field lives inside, and Where pins the
	// entry of it the values are read from — the key of a key/value tag list.
	//
	// Both are required for a nested field to answer at all: its entries are
	// indexed as separate documents, so an aggregation that does not descend into
	// them returns no buckets, and one that descends without pinning the entry
	// returns every tag's values mixed together.
	Nested string
	Where  map[string]string
}

ValuesRequest asks what a field holds. Body scopes the question to the documents a query already narrows to; nil asks the whole index.

type ValuesResult added in v0.1.29

type ValuesResult struct {
	Values []Value `json:"values"`
	Total  int     `json:"total"`
}

ValuesResult carries the values the terms aggregation returned and how many distinct ones exist behind them, which is what tells an author the list is a window rather than the whole set.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL