diff --git a/pom.xml b/pom.xml
index 6f21190..57f520f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -9,7 +9,7 @@
org.graylog.plugins
graylog-plugin-slookup-function
- 2.0.0
+ 4.1.0
jar
${project.artifactId}
@@ -34,7 +34,7 @@
UTF-8
1.8
1.8
- 2.3.2
+ 4.1.0
/usr/share/graylog-server/plugin
@@ -46,10 +46,14 @@
provided
- org.graylog.plugins
- graylog-plugin-pipeline-processor
- 1.1.1
- provided
+ org.elasticsearch.client
+ elasticsearch-rest-high-level-client
+ 7.7.0
+
+
+ org.elasticsearch
+ elasticsearch
+ 7.7.0
diff --git a/src/main/java/org/graylog/plugins/slookup/StreamLookupFunction.java b/src/main/java/org/graylog/plugins/slookup/StreamLookupFunction.java
index b58b3a9..db0b7df 100644
--- a/src/main/java/org/graylog/plugins/slookup/StreamLookupFunction.java
+++ b/src/main/java/org/graylog/plugins/slookup/StreamLookupFunction.java
@@ -1,6 +1,8 @@
package org.graylog.plugins.slookup;
import org.elasticsearch.action.search.SearchPhaseExecutionException;
+import org.elasticsearch.search.sort.SortOrder;
+
import org.graylog2.indexer.results.ResultMessage;
import org.graylog2.indexer.results.SearchResult;
import org.graylog2.indexer.searches.SearchesConfig;
@@ -12,6 +14,7 @@
import org.graylog.plugins.pipelineprocessor.EvaluationContext;
import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression;
import org.graylog.plugins.pipelineprocessor.ast.functions.*;
+
import static com.google.common.collect.ImmutableList.of;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -88,7 +91,13 @@ public List evaluate(FunctionArgs functionArgs, EvaluationContext evalua
blankList.add("No match found");
}
- this.timeRange = RelativeRange.builder().type("relative").range(timeRange).build();
+ //this.timeRange = RelativeRange.builder().type("relative").range(timeRange).build();
+ //this was changed in Graylog 4.1 to include an optional from/to instead of just range
+ try {
+ this.timeRange = RelativeRange.create(timeRange.intValue());
+ } catch (Exception e) {
+ LOG.info(e.getMessage());
+ }
String srcFieldValue = evaluationContext.currentMessage().getField(srcField).toString();
String escapeChars ="[\\\\+\\-\\!\\(\\)\\:\\^\\]\\{\\}\\~\\*\\?]";
@@ -103,12 +112,12 @@ public List evaluate(FunctionArgs functionArgs, EvaluationContext evalua
if (sortField.equals("asc")) {
this.sortType = new Sorting("timestamp", Sorting.Direction.ASC);
- LOG.debug("This sortType - field: {}, order: {}", this.sortType.getField().toString(), this.sortType.asElastic().toString());
+ LOG.debug("This sortType - field: {}, order: {}", this.sortType.getField().toString(), this.sortType.toString());
}
else
{
this.sortType = new Sorting("timestamp", Sorting.Direction.DESC);
- LOG.debug("This sortType - field: {}, order: {}", this.sortType.getField().toString(), this.sortType.asElastic().toString());
+ LOG.debug("This sortType - field: {}, order: {}", this.sortType.getField().toString(), this.sortType.toString());
}
final SearchesConfig searchesConfig = SearchesConfig.builder()
@@ -123,7 +132,7 @@ public List evaluate(FunctionArgs functionArgs, EvaluationContext evalua
try {
SearchResult response = this.searches.search(searchesConfig);
- LOG.debug("Search config - field: {}, order: {}", searchesConfig.sorting().getField().toString(), searchesConfig.sorting().asElastic().toString());
+ LOG.debug("Search config - field: {}, order: {}", searchesConfig.sorting().getField().toString(), searchesConfig.sorting().toString());
if (response.getResults().size() == 0) {
LOG.debug("No Search Results observed.");
return blankList;