Untitled
user_3839718
plain_text
2 years ago
1.4 kB
8
Indexable
func observableQueryGenerator(robotId string, observableNames []string) string {
interfaceSlice := make([]interface{}, len(observableNames))
for i, v := range observableNames {
interfaceSlice[i] = v
}
observableNameList, err := json.Marshal(observableNames)
if err != nil {
log.Fatal(err)
}
query := fmt.Sprintf(`{"size": 0,
"query": {
"bool": {
"must": [
{
"match": {
"robot_id": "%s"
}
},
{
"terms": {
"observable_name": %s
}
}
]
}
},
{"range":{"timestamp":{"gte":"now/d",
"lt":"now+1d/d"
}
}
},
"aggs": {
"per_observable": {
"terms": {
"field": "observable_name.keyword",
"size": 3
},
"aggs": {
"latest_value": {
"top_hits": {
"sort": [
{
"timestamp": {
"order": "desc"
}
}
],
"_source": {
"includes": ["observable_name", "value", "timestamp", "x", "y", "z"]
},
"size": 1
}
}
}
}
}
}
`, robotId, observableNameList)
return query
}
Editor is loading...
Leave a Comment