andrewvc

input {
  generator {
    message => "baz=bot blah=bar"
    count => 10000000
  }
}

filter {
  kv {}
  mutate {

andrewvc

input {
  stdin {}
}

filter {
  grok {
    match => {
      "message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}'
    }
  }

andrewvc

_type: product
name: Vacuum Cleaner
---
_type: product
name: Turkey Baster

andrewvc

An Elasticsearch in Crash Course!

By Andrew Cholakian

All examples use the Stretcher ruby gem

What is Elasticsearch?

• An Information Retrieval (IR) System
• A way to search your data in terms of natural language, and so much more

andrewvc

# Turn version number into a 48 bit value (16 bits per version number) that is comparable to other versions
def rank_version(ver_str)
  ver_str.
    split('.').
    map(&:to_i).
    reduce([5*16,0]) {|acc,v| #These vars are horribly named
      i,a=acc
      [i - 16, a | (v << i) ]
  }[1]
end

andrewvc

#command-bar
  %form#client
    .labels
      %label#ajax-method-label{for: "method"} Method
      %label#server-label{for: "server"} Server
      %label#path-label{for: "Path"} Path
    .fields
      %select#ajax-method{name: "method"}
        %option{value: "GET"} GET
        %option{value: "PUT"} PUT  

andrewvc

irb(main):021:0> x = "foobar"
=> "foobar"
irb(main):022:0> x =~ /(foo)/
=> 0
irb(main):023:0> $1
=> "foo"
irb(main):024:0> Thread.new { x =~ /(bar)/; puts $1}.join
bar
=> #<Thread:0x007ff47a10cb58 dead>
irb(main):025:0> $1

andrewvc

(ns something
  (:import [java.io
            BufferedWriter
            BufferedReader
            OutputStreamWriter
            InputStreamReader
            FileOutputStream
            FileInputStream]
           [java.util.zip
            GZIPOutputStream

andrewvc

input {
  generator {
    lines => ["foo", "bar", "baz", "something bad"]
    count => 1000000
  }
}

filter {
  if [message] == "foo" {
    mutate { add_field => { "is_foo" => true }}

andrewvc

use std;

import io::println;
import io::reader_util;

type birth_row = {
    prglength: int,
    outcome: int,
    birthord: int};