CPAN::Groonga

::ESsearcher;

use 5.006;
use base Error::Helper;
use strict;
use warnings;
use Getopt::Long;
use JSON;
use Template;
use Search::Elasticsearch;
use Term::ANSIColor;
use Time::ParseDate;

=head1 NAME

		  EVAL_PERL=>1,
							  INTERPOLATE=>1,
							  POST_CHOMP=>1,
							  });

	# inits JSON
	$self->{j}=JSON->new;
	$self->{j}->pretty(1); # make the output sanely human readable
	$self->{j}->relax

 load_elastic

This loads the currently specified config file
containing the Elasticsearch config JSON.

    $ess->load_elastic;

=cut

sub load_elastic{
	my $self=$_[0];

	if ( ! $self->errorblank ) 

n '
[% USE JSON ( pretty => 1 ) %]
[% DEFAULT o.size = "50" %]
[% DEFAULT o.field = "type" %]
[% DEFAULT o.fieldv = "syslog" %]
{
 "index": "logstash-*",
 "body": {
	 "size": [% o.size.json %],
	 "que

{ [% o.field.json %]: [% o.fieldv.json %] }
					   },
					  [% IF o.host %]
					  {"query_string": {
						  "default_field": "host.keyword",
						  "query": [% aonHost( o.host ).json %]
					  }

y": [% o.hostx.json %]
					  }
					   },
					  [% END %]
					  [% IF o.srcx %]
					  {"query_string": {
						  "default_field": "logsource.keyword",
						  "query": [% o.srcx.json %]
					  }
	

not matching maching any of the above will just be passed on.

=cut


sub search{
return '
[% USE JSON ( pretty => 1 ) %]
[% DEFAULT o.size = "50" %]
[% DEFAULT o.field = "type" %]
[% DEFAULT o.fieldv

e.json %],
	 "query": {
		 "bool": {
			 "must": [
					  {
					   "term": { [% o.field.json %]: [% o.fieldv.json %] }
					   },
					  {"query_string": {
						  "default_field": [% o.field2.json %

": [% o.field2v.json %]
					  }
					   },
					  [% IF o.country %]
					  {"query_string": {
						  "default_field": "geoip.country_code2",
						  "query": [% aon( o.country ).json %]
					  }
		

not matching maching any of the above will just be passed on.

=cut


sub search{
return '
[% USE JSON ( pretty => 1 ) %]
[% DEFAULT o.program = "postfix" %]
[% DEFAULT o.facility = "mail" %]
[% DEFAU

logstash-*",
 "body": {
	 "size": [% o.size.json %],
	 "query": {
		 "bool": {
			 "must": [
					  {
					   "term": { [% o.field.json %]: [% o.fieldv.json %] }
					   },
                      [% IF

.json %]
					  }
					   },
                      [% END %]
                      [% IF o.hostx %]
					  {"query_string": {
						  "default_field": "host.keyword",
						  "query": [% o.hostx.json 

not matching maching any of the above will just be passed on.

=cut


sub search{
return '
[% USE JSON ( pretty => 1 ) %]
[% DEFAULT o.size = "50" %]
[% DEFAULT o.field = "type" %]
[% DEFAULT o.fieldv

ze.json %],
	 "query": {
		 "bool": {
			 "must": [
					  {
					   "term": { [% o.field.json %]: [% o.fieldv.json %] }
					   },
					  {
					   "term": { [% o.field2.json %]: [% o.field2v.json %]

ountry ).json %]
					  }
					   },
					  [% END %]
					  [% IF o.region %]
					  {"query_string": {
						  "default_field": "geoip.region_code",
						  "query": [% aon( o.region ).json %]