org.graylog2.indexer.Mapping Maven / Gradle / Ivy

Show more of this group Show more artifacts with this name
Show all versions of graylog2-server Show documentation
Graylog
There is a newer version: 6.0.6
/**
 * This file is part of Graylog.
 *
 * Graylog is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * Graylog is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Graylog.  If not, see .
 */
package org.graylog2.indexer;

import com.google.common.collect.Maps;
import org.elasticsearch.action.admin.indices.mapping.put.PutMappingRequest;
import org.elasticsearch.action.admin.indices.mapping.put.PutMappingRequestBuilder;
import org.elasticsearch.client.Client;
import org.graylog2.indexer.messages.Messages;
import org.graylog2.plugin.Tools;

import java.util.HashMap;
import java.util.LinkedList;
import java.util.List;
import java.util.Map;


/**
 * Representing the message type mapping in ElasticSearch. This is giving ES more
 * information about what the fields look like and how it should analyze them.
 *
 * @author Lennart Koopmann 
 */
@SuppressWarnings({"unchecked"})
public class Mapping {

    public static PutMappingRequest getPutMappingRequest(final Client client, final String index, final String analyzer) {
        final PutMappingRequestBuilder builder = client.admin().indices().preparePutMapping(new String[] {index});
        builder.setType(Messages.TYPE);

        final Map mapping = new HashMap();
        mapping.put("properties", partFieldProperties(analyzer));
        mapping.put("dynamic_templates", partDefaultAllInDynamicTemplate());
        mapping.put("_source", enabledAndCompressed()); // Compress source field..
        mapping.put("_ttl", enabled()); // Enable purging by TTL.

        // TODO: use multimap?
        final Map> completeMapping = Maps.newHashMap();
        completeMapping.put(Messages.TYPE, mapping);

        builder.setSource(completeMapping);
        return builder.request();
    }

    /*
     * Disable analyzing for every field by default.
     */
    // TODO warnings
    @SuppressWarnings("rawtypes")
	private static List partDefaultAllInDynamicTemplate() {
        final List dynamicTemplates = new LinkedList();
        final Map template = new HashMap();
        final Map defaultAll = new HashMap();
        final Map notAnalyzed = new HashMap();
        notAnalyzed.put("index", "not_analyzed");

        // Match all.
        defaultAll.put("match", "*");
        // Analyze nothing by default.
        defaultAll.put("mapping", notAnalyzed);

        template.put("store_generic", defaultAll);
        dynamicTemplates.add(template);

        return dynamicTemplates;
    }

    /*
     * Enable analyzing for some fields again. Like for message and full_message.
     */
    // TODO warnings
    @SuppressWarnings("rawtypes")
	private static Map partFieldProperties(String analyzer) {
        final Map> properties = Maps.newHashMap();

        properties.put("message", analyzedString(analyzer));
        properties.put("full_message", analyzedString(analyzer));

        // http://joda-time.sourceforge.net/api-release/org/joda/time/format/DateTimeFormat.html
        // http://www.elasticsearch.org/guide/reference/mapping/date-format.html
        properties.put("timestamp", typeTimeWithMillis());

        // to support wildcard searches in source we need to lowercase the content (wildcard search lowercases search term)
        properties.put("source", analyzedString("analyzer_keyword"));

        return properties;
    }

    private static Map analyzedString(String analyzer) {
        final Map type = Maps.newHashMap();
        type.put("index", "analyzed");
        type.put("type", "string");
        type.put("analyzer", analyzer);

        return type;
    }

    private static Map typeTimeWithMillis() {
        final Map type = Maps.newHashMap();
        type.put("type", "date");
        type.put("format", Tools.ES_DATE_FORMAT);

        return type;
    }

    private static Map enabled() {
        final Map e = Maps.newHashMap();
        e.put("enabled", true);

        return e;
    }

    
    private static Map enabledAndCompressed() {
        final Map e = Maps.newHashMap();
        e.put("enabled", true);
        e.put("compress", true);

        return e;
    }

}