Untitled

 avatar
user_3839718
plain_text
21 days ago
1.4 kB
3
Indexable
Never
func observableQueryGenerator(robotId string, observableNames []string) string {
	interfaceSlice := make([]interface{}, len(observableNames))
	for i, v := range observableNames {
		interfaceSlice[i] = v
	}

	observableNameList, err := json.Marshal(observableNames)
	if err != nil {
		log.Fatal(err)
	}
	query := fmt.Sprintf(`{"size": 0, 
								  "query": {
									"bool": {
									  "must": [
										{
										  "match": {
											"robot_id": "%s"
										  }
										},
										{
										  "terms": {
											"observable_name": %s
										  }
										}
									  ]
									}
								  },
									{"range":{"timestamp":{"gte":"now/d",
															"lt":"now+1d/d"
														 }
													  }
								  },
								  "aggs": {
									"per_observable": {
									  "terms": {
										"field": "observable_name.keyword",
										"size": 3 
									  },
									  "aggs": {
										"latest_value": {
										  "top_hits": {
											"sort": [
											  {
												"timestamp": {
												  "order": "desc"
												}
											  }
											],
											"_source": {
											  "includes": ["observable_name", "value", "timestamp", "x", "y", "z"]
											},
											"size": 1
										  }
										}
									  }
									}
								  }
								}
								`, robotId, observableNameList)

	return query
}
Leave a Comment