Integrations/Elasticsearch_v2/Elasticsearch_v2.py
def results_to_incidents_datetime(response, last_fetch):
    """Converts the current results into incidents.

    Args:
        response(dict): the raw search results from Elasticsearch.
        last_fetch(datetime): the date or timestamp of the last fetch before this fetch
        - this will hold the last date of the incident brought by this fetch.

    Returns:
        (list).The incidents.
        (datetime).The date of the last incident brought by this fetch.
    """
    last_fetch_timestamp = int(last_fetch.timestamp() * 1000)
    current_fetch = last_fetch_timestamp
    incidents = []

    for hit in response.get('hits', {}).get('hits'):
        if hit.get('_source') is not None and hit.get('_source').get(str(TIME_FIELD)) is not None:
            hit_date = parse(str(hit.get('_source')[str(TIME_FIELD)]))
            hit_timestamp = int(hit_date.timestamp() * 1000)

            if hit_timestamp > last_fetch_timestamp:
                last_fetch = hit_date
                last_fetch_timestamp = hit_timestamp

            # avoid duplication due to weak time query
            if hit_timestamp > current_fetch:
                inc = {
                    'name': 'Elasticsearch: Index: ' + str(hit.get('_index')) + ", ID: " + str(hit.get('_id')),
                    'rawJSON': json.dumps(hit),
                    'labels': incident_label_maker(hit.get('_source')),
                    # parse function returns iso format sometimes as YYYY-MM-DDThh:mm:ss+00:00
                    # and sometimes as YYYY-MM-DDThh:mm:ss
                    # we want to return format: YYYY-MM-DDThh:mm:ssZ in our incidents
                    'occurred': format_to_iso(hit_date.isoformat())
                }
                incidents.append(inc)

    return incidents, format_to_iso(last_fetch.isoformat())
Converts the current results into incidents.

    Args:
        response(dict): the raw search results from Elasticsearch.
        last_fetch(datetime): the date or timestamp of the last fetch before this fetch
        - this will hold the last date of the incident brought by this fetch.

    Returns:
        (list).The incidents.
        (datetime).The date of the last incident brought by this fetch.
    
Converts the current results into incidents.
Args:
response(dict): the raw search results from Elasticsearch.
last_fetch(datetime): the date or timestamp of the last fetch before this fetch
this will hold the last date of the incident brought by this fetch.

(list).The incidents.
(datetime).The date of the last incident brought by this fetch.
Converts the current results into incidents . Args : response ( dict ) : the raw search results from Elasticsearch . last_fetch ( datetime ) : the date or timestamp of the last fetch before this fetch this will hold the last date of the incident brought by this fetch . ( list ) . The incidents . ( datetime ) . The date of the last incident brought by this fetch .
def results_to_incidents_datetime(response, last_fetch):
    last_fetch_timestamp = int(last_fetch.timestamp() * 1000)
    current_fetch = last_fetch_timestamp
    incidents = []
    for hit in response.get('hits', {}).get('hits'):
        if hit.get('_source') is not None and hit.get('_source').get(str(TIME_FIELD)) is not None:
            hit_date = parse(str(hit.get('_source')[str(TIME_FIELD)]))
            hit_timestamp = int(hit_date.timestamp() * 1000)
            if hit_timestamp > last_fetch_timestamp:
                last_fetch = hit_date
                last_fetch_timestamp = hit_timestamp
            if hit_timestamp > current_fetch:
                inc = {
                    'name': 'Elasticsearch: Index: ' + str(hit.get('_index')) + ", ID: " + str(hit.get('_id')),
                    'rawJSON': json.dumps(hit),
                    'labels': incident_label_maker(hit.get('_source')),
                    'occurred': format_to_iso(hit_date.isoformat())
                }
                incidents.append(inc)
    return incidents, format_to_iso(last_fetch.isoformat())
def results_to_incidents_datetime ( response , last_fetch ) : last_fetch_timestamp = int ( last_fetch . timestamp ( ) * 1000 ) current_fetch = last_fetch_timestamp incidents = [ ] for hit in response . get ( 'hits' , { } ) . get ( 'hits' ) : if hit . get ( '_source' ) is not None and hit . get ( '_source' ) . get ( str ( TIME_FIELD ) ) is not None : hit_date = parse ( str ( hit . get ( '_source' ) [ str ( TIME_FIELD ) ] ) ) hit_timestamp = int ( hit_date . timestamp ( ) * 1000 ) if hit_timestamp > last_fetch_timestamp : last_fetch = hit_date last_fetch_timestamp = hit_timestamp if hit_timestamp > current_fetch : inc = { 'name' : 'Elasticsearch: Index: ' + str ( hit . get ( '_index' ) ) + ", ID: " + str ( hit . get ( '_id' ) ) , 'rawJSON' : json . dumps ( hit ) , 'labels' : incident_label_maker ( hit . get ( '_source' ) ) , 'occurred' : format_to_iso ( hit_date . isoformat ( ) ) } incidents . append ( inc ) return incidents , format_to_iso ( last_fetch . isoformat ( ) )
Converts the current results into incidents.
Converts the current results into incidents .
"""Converts the current results into incidents.

    Args:
        response(dict): the raw search results from Elasticsearch.
        last_fetch(datetime): the date or timestamp of the last fetch before this fetch
        - this will hold the last date of the incident brought by this fetch.

    Returns:
        (list).The incidents.
        (datetime).The date of the last incident brought by this fetch.
    """ # avoid duplication due to weak time query # parse function returns iso format sometimes as YYYY-MM-DDThh:mm:ss+00:00 # and sometimes as YYYY-MM-DDThh:mm:ss # we want to return format: YYYY-MM-DDThh:mm:ssZ in our incidents
response
last_fetch