diff --git a/pom.xml b/pom.xml index 6f21190..57f520f 100644 --- a/pom.xml +++ b/pom.xml @@ -9,7 +9,7 @@ org.graylog.plugins graylog-plugin-slookup-function - 2.0.0 + 4.1.0 jar ${project.artifactId} @@ -34,7 +34,7 @@ UTF-8 1.8 1.8 - 2.3.2 + 4.1.0 /usr/share/graylog-server/plugin @@ -46,10 +46,14 @@ provided - org.graylog.plugins - graylog-plugin-pipeline-processor - 1.1.1 - provided + org.elasticsearch.client + elasticsearch-rest-high-level-client + 7.7.0 + + + org.elasticsearch + elasticsearch + 7.7.0 diff --git a/src/main/java/org/graylog/plugins/slookup/StreamLookupFunction.java b/src/main/java/org/graylog/plugins/slookup/StreamLookupFunction.java index b58b3a9..db0b7df 100644 --- a/src/main/java/org/graylog/plugins/slookup/StreamLookupFunction.java +++ b/src/main/java/org/graylog/plugins/slookup/StreamLookupFunction.java @@ -1,6 +1,8 @@ package org.graylog.plugins.slookup; import org.elasticsearch.action.search.SearchPhaseExecutionException; +import org.elasticsearch.search.sort.SortOrder; + import org.graylog2.indexer.results.ResultMessage; import org.graylog2.indexer.results.SearchResult; import org.graylog2.indexer.searches.SearchesConfig; @@ -12,6 +14,7 @@ import org.graylog.plugins.pipelineprocessor.EvaluationContext; import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; import org.graylog.plugins.pipelineprocessor.ast.functions.*; + import static com.google.common.collect.ImmutableList.of; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -88,7 +91,13 @@ public List evaluate(FunctionArgs functionArgs, EvaluationContext evalua blankList.add("No match found"); } - this.timeRange = RelativeRange.builder().type("relative").range(timeRange).build(); + //this.timeRange = RelativeRange.builder().type("relative").range(timeRange).build(); + //this was changed in Graylog 4.1 to include an optional from/to instead of just range + try { + this.timeRange = RelativeRange.create(timeRange.intValue()); + } catch (Exception e) { + LOG.info(e.getMessage()); + } String srcFieldValue = evaluationContext.currentMessage().getField(srcField).toString(); String escapeChars ="[\\\\+\\-\\!\\(\\)\\:\\^\\]\\{\\}\\~\\*\\?]"; @@ -103,12 +112,12 @@ public List evaluate(FunctionArgs functionArgs, EvaluationContext evalua if (sortField.equals("asc")) { this.sortType = new Sorting("timestamp", Sorting.Direction.ASC); - LOG.debug("This sortType - field: {}, order: {}", this.sortType.getField().toString(), this.sortType.asElastic().toString()); + LOG.debug("This sortType - field: {}, order: {}", this.sortType.getField().toString(), this.sortType.toString()); } else { this.sortType = new Sorting("timestamp", Sorting.Direction.DESC); - LOG.debug("This sortType - field: {}, order: {}", this.sortType.getField().toString(), this.sortType.asElastic().toString()); + LOG.debug("This sortType - field: {}, order: {}", this.sortType.getField().toString(), this.sortType.toString()); } final SearchesConfig searchesConfig = SearchesConfig.builder() @@ -123,7 +132,7 @@ public List evaluate(FunctionArgs functionArgs, EvaluationContext evalua try { SearchResult response = this.searches.search(searchesConfig); - LOG.debug("Search config - field: {}, order: {}", searchesConfig.sorting().getField().toString(), searchesConfig.sorting().asElastic().toString()); + LOG.debug("Search config - field: {}, order: {}", searchesConfig.sorting().getField().toString(), searchesConfig.sorting().toString()); if (response.getResults().size() == 0) { LOG.debug("No Search Results observed."); return blankList;