extra/docker/elk/tools/EsAutoQuery/timeSince.json

   1 {
   2     "query" : {
   3         "match_all": {}
   4     },
   5     "script_fields" : {
   6         "timeSince" : {
   7             "script" : {
   8                 "lang": "painless",
   9                 "source": "
  10 long now = System.currentTimeMillis();
  11 if (doc.get('closedLoopEventStatus.keyword').value == 'ABATED') {
  12    return now - doc.get('closedLoopAlarmEnd').value;
  13 }
  14 if (doc.get('closedLoopEventStatus.keyword').value == 'ONSET') {
  15    return now - doc.get('closedLoopAlarmStart').value;
  16 }
  17 if (doc.containsKey('notification.keyword')) {
  18    return now - doc.get('notificationTime').value;
  19 }
  20
  21 return null
  22 "
  23             }
  24         }
  25         , "closedLoopAlarmStart" : {
  26             "script" : {
  27                 "lang": "painless",
  28                 "source": "doc['closedLoopAlarmStart']"
  29             }
  30         }
  31         , "closedLoopEventStatus" : {
  32             "script" : {
  33                 "lang": "painless",
  34                 "source": "doc['closedLoopEventStatus.keyword']"
  35             }
  36         }
  37         , "notification" : {
  38             "script" : {
  39                 "lang": "painless",
  40                 "source": "doc['notification.keyword']"
  41             }
  42         }
  43         , "notificationTime" : {
  44             "script" : {
  45                 "lang": "painless",
  46                 "source": "doc['notificationTime'].value"
  47             }
  48         }
  49
  50     }
  51 }