Merge pull request #51 from alexweltman/3.2.1_AddAutoCapAndAuditToOth…

…erPages Added field name capitalization to discover and visualize
logrhythm · Jul 13, 2016 · 46dc4d6 · 46dc4d6
2 parents 84193d2 + 37e0a24
commit 46dc4d6
Show file tree

Hide file tree

Showing 4 changed files with 222 additions and 196 deletions.
diff --git a/src/kibana/netmon_libs/custom_modules/save_rule/services/searchAuditor.js b/src/kibana/netmon_libs/custom_modules/save_rule/services/searchAuditor.js
@@ -1,12 +1,20 @@
 define(function (require) {
     var app = require('modules').get('app/dashboard');
-    app.factory('searchAuditor', function (elasticSearchFields,
-                                           Restangular) {
-        var previousQuery = {
-            query    : "",
-            fromDate : "",
-            toDate   : ""
-        };
+    var _ = require('lodash');
+    var moment = require('moment');
+    var angular = require('angular');
+
+    var timefilter = require('components/timefilter/timefilter');
+    app.factory('searchAuditor', function (elasticSearchFields, 
+      Restangular, timefilter) {
+         var FORMAT_STRING = 'YYYY/MM/DD HH:mm:ss';
+         var INDEX_PATTERN = '[network_]YYYY_MM_DD';
+
+         var previousQuery = {
+             query    : '',
+             fromDate : '',
+             toDate   : ''
+         };
         var formatQuery = function(query) {
             var _query = _.isArray(query) ? query : [query];
             if (_.isArray(_query)) {
@@ -22,44 +30,65 @@ define(function (require) {
             }
             return _query;
         };
-        return {
-            autoCapQuery : function(query) {
-                return formatQuery(query)[0];
-            },
-            logQuery : function(query, from, to) {
-                // ignore these searches for search auditing
-                if (!from || !to || 
-                    query === "" || 
-                    query === "*") {
-                    return;
-                }
-                var formatString = "YYYY/MM/DD HH:mm:ss";
-                var from = moment(from).format(formatString);
-                var to = moment(to).format(formatString);
-                if (query === previousQuery.query &&
-                    from === previousQuery.fromDate &&
-                    to === previousQuery.toDate) {
-                    return;
-                }
-                previousQuery = {
+
+        var logQuery = function(query) {
+            // ignore these searches for search auditing
+
+            var timeRange = timefilter.getBounds();
+            var timeFrom = timeRange.min;
+            var timeTo = timeRange.max;
+
+            if (!timeFrom || !timeTo || 
+                query === '' || 
+                query === '*') {
+                return;
+            }
+
+            timeFrom = moment(timeFrom).format(FORMAT_STRING);
+            timeTo = moment(timeTo).format(FORMAT_STRING);
+
+            if (query === previousQuery.query &&
+                timeFrom === previousQuery.fromDate &&
+                timeTo === previousQuery.toDate) {
+                return;
+            }
+            previousQuery = {
+                query    : query,
+                fromDate : timeFrom,
+                toDate   : timeTo
+            };
+            Restangular
+                .all('audit/')
+                .post({
                     query    : query,
-                    fromDate : from,
-                    toDate   : to
+                    from     : timeFrom,
+                    to       : timeTo
+                })
+                .then(function(response){
+                    if (response.error){
+                        var error = response.message || 'An unknown error occured';
+                        console.log('Search Audit Error:', error);
+                    }
+                });
+        };
+
+        return {
+            logAndCapitalize : function(query) {
+                var capitalizedQuery = formatQuery(query.query_string.query)[0];
+                logQuery(capitalizedQuery);
+                // seems like we need to create a new object to force angular to reflect the
+                // query change in the view
+
+                var newQuery =
+                  {
+                    query_string : {
+                       query : capitalizedQuery,
+                       analyze_wildcard : query.query_string.analyze_wildcard
+                  }
                 };
-                Restangular
-                    .all('audit/')
-                    .post({
-                        query    : query,
-                        from     : from,
-                        to       : to
-                    })
-                    .then(function(response){
-                        if (response.error){
-                            var error = response.message || "An unknown error occured";
-                            console.log('Search Audit Error:', error);
-                        }
-                    });
+                return newQuery;
             }
+
         };
     });
 });