elasticctl_api/search/
dataview.rs

1//! Kibana data-view resolution and the default alerts index.
2
3use crate::data_views_ops;
4use elasticctl_core::{Error, ErrorKind, Result, Transport};
5use serde_json::Value;
6
7/// Match a `GET /api/data_views` body to one data view by `id` or `name`
8/// (exact), returning its `title` (the comma-separated index pattern).
9pub fn resolve_title(body: &Value, name: &str) -> Result<String> {
10    let views = body
11        .get("data_view")
12        .and_then(Value::as_array)
13        .ok_or_else(|| {
14            Error::new(
15                ErrorKind::Http,
16                "decoding data views response field `data_view`",
17            )
18        })?;
19    let view = data_views_ops::select_by_id_or_name(
20        views,
21        name,
22        |view| view.get("id").and_then(Value::as_str),
23        |view| view.get("name").and_then(Value::as_str),
24    )?;
25    view.get("title")
26        .and_then(Value::as_str)
27        .map(str::to_owned)
28        .ok_or_else(|| Error::new(ErrorKind::Http, "decoding data view field `title`"))
29}
30
31/// Resolve a data view over the wire.
32pub async fn resolve(t: &Transport, name: &str) -> Result<String> {
33    let body = t.get("/api/data_views").await?;
34    resolve_title(&body, name)
35}
36
37/// The space's default alerts index, from `GET /api/detection_engine/index`.
38pub async fn default_alerts_index(t: &Transport) -> Result<String> {
39    let body = t.get("/api/detection_engine/index").await?;
40    body.get("name")
41        .and_then(Value::as_str)
42        .map(str::to_owned)
43        .ok_or_else(|| {
44            Error::new(
45                ErrorKind::Http,
46                "decoding detection engine index field `name`",
47            )
48        })
49}
elasticctl_api/search/dataview.rs

elasticctl_api/search/
dataview.rs
