diff --git a/server/global/global.go b/server/global/globalConst.go similarity index 100% rename from server/global/global.go rename to server/global/globalConst.go diff --git a/server/global/template/cluster.go b/server/global/template/cluster.go index 15cc7155a1eccd8793268530634a1d47edc807de..994a7316ac2ed08b01ed5164e6cc7a9feb2c6e3e 100644 --- a/server/global/template/cluster.go +++ b/server/global/template/cluster.go @@ -1,7 +1,7 @@ package template var ( - DSL_template_map map[string]string + DSL_template_map map[string][]string ) const ( @@ -161,11 +161,110 @@ const ( } }` + + DSL_log_stream_template = `{ + "script": { + "lang": "mustache", + "source": { + "from": "{{from}}", + "size": "{{size}}", + "sort": [ + { + "@timestamp": { + "order": "desc", + "unmapped_type": "boolean" + } + } + ], + "fields": [ + { + "field": "*", + "include_unmapped": "true" + }, + { + "field": "@timestamp", + "format": "strict_date_optional_time" + }, + { + "field": "event.created", + "format": "strict_date_optional_time" + }, + { + "field": "event.ingested", + "format": "strict_date_optional_time" + } + ], + "script_fields": {}, + "stored_fields": [ + "*" + ], + "runtime_mappings": {}, + "query": { + "bool": { + "must": [], + "filter": [ + { + "bool": { + "must": [ + { + "match": { + "data_stream.dataset": "{{query_data_stream_dataset}}" + } + }, + { + "term": { + "host.hostname": "{{hostname}}" + } + }, + { + "term": { + "process.name": "{{processname}}" + } + } + ] + } + }, + { + "range": { + "@timestamp": { + "format": "strict_date_optional_time", + "gte": "{{query_range_gte}}", + "lte": "{{query_range_lte}}" + } + } + } + ], + "should": [], + "must_not": [] + } + } + }, + "params": { + "query_data_stream_dataset": "system.syslog", + "query_range_gte": "2024-06-24T10:55:36.185Z", + "query_range_lte": "2024-06-24T11:00:36.185Z", + "hostname": "wjq-pc", + "processname": "systemd", + "from": 0, + "size": 10 + } + } + }` ) func init() { - DSL_template_map = map[string]string{ - "log_clusterhost_timeaxis": DSL_log_clusterhost_timeaxis_template, - "log_hostprocess_timeaxis": DSL_log_hostprocess_timeaxis_template, + DSL_template_map = map[string][]string{ + "log_clusterhost_timeaxis": { + DSL_log_clusterhost_timeaxis_template, + "ProcessLogTimeAixsData", + }, + "log_hostprocess_timeaxis": { + DSL_log_hostprocess_timeaxis_template, + "ProcessLogTimeAixsData", + }, + "log_stream": { + DSL_log_stream_template, + "ProcessLogStreamData", + }, } }