elasticctl_api/search/
dataview.rs

1//! Kibana data-view resolution and the default alerts index.
2
3use elasticctl_core::{Error, ErrorKind, Result, Transport};
4use serde_json::Value;
5
6/// Match a `GET /api/data_views` body to one data view by `id` or `name`
7/// (exact), returning its `title` (the comma-separated index pattern).
8pub fn resolve_title(body: &Value, name: &str) -> Result<String> {
9    let views = body
10        .get("data_view")
11        .and_then(Value::as_array)
12        .ok_or_else(|| {
13            Error::new(
14                ErrorKind::Http,
15                "decoding data views response field `data_view`",
16            )
17        })?;
18    let matches: Vec<&Value> = views
19        .iter()
20        .filter(|v| {
21            v.get("id").and_then(Value::as_str) == Some(name)
22                || v.get("name").and_then(Value::as_str) == Some(name)
23        })
24        .collect();
25    match matches.as_slice() {
26        [] => Err(Error::new(
27            ErrorKind::NotFound,
28            format!("no data view with id or name '{name}'"),
29        )),
30        [one] => one
31            .get("title")
32            .and_then(Value::as_str)
33            .map(str::to_owned)
34            .ok_or_else(|| Error::new(ErrorKind::Http, "decoding data view field `title`")),
35        _ => Err(Error::new(
36            ErrorKind::Conflict,
37            format!("data view '{name}' is ambiguous"),
38        )),
39    }
40}
41
42/// Resolve a data view over the wire.
43pub async fn resolve(t: &Transport, name: &str) -> Result<String> {
44    let body = t.get("/api/data_views").await?;
45    resolve_title(&body, name)
46}
47
48/// The space's default alerts index, from `GET /api/detection_engine/index`.
49pub async fn default_alerts_index(t: &Transport) -> Result<String> {
50    let body = t.get("/api/detection_engine/index").await?;
51    body.get("name")
52        .and_then(Value::as_str)
53        .map(str::to_owned)
54        .ok_or_else(|| {
55            Error::new(
56                ErrorKind::Http,
57                "decoding detection engine index field `name`",
58            )
59        })
60}
elasticctl_api/search/dataview.rs

elasticctl_api/search/
dataview.rs
