(self)
return data_frame
Returns a pandas DataFrame with the response of the query.
Returns a pandas DataFrame with the response of the query.
Returns a pandas DataFrame with the response of the query .
def to_pandas(self):
        """Returns a pandas DataFrame with the response of the query."""
        if not self._raw_response:
            self._execute_query()

        return_list = []
        timelines = {
            t.id: t.name for t in self._sketch.list_timelines()}

        return_field_list = []
        return_fields = self._return_fields
        if return_fields:
            if return_fields.startswith('\''):
                return_fields = return_fields[1:]
            if return_fields.endswith('\''):
                return_fields = return_fields[:-1]
            return_field_list = return_fields.split(',')

        for result in self._raw_response.get('objects', []):
            source = result.get('_source', {})
            if not return_fields or '_id' in return_field_list:
                source['_id'] = result.get('_id')
            if not return_fields or '_type' in return_field_list:
                source['_type'] = result.get('_type')
            if not return_fields or '_index' in return_field_list:
                source['_index'] = result.get('_index')
            if not return_fields or '_source' in return_field_list:
                source['_source'] = timelines.get(
                    result.get('__ts_timeline_id'))
            if not return_fields or '__ts_timeline_id' in return_field_list:
                source['_source'] = timelines.get(
                    result.get('__ts_timeline_id'))

            return_list.append(source)

        data_frame = pandas.DataFrame(return_list)
        if 'datetime' in data_frame:
            try:
                data_frame['datetime'] = pandas.to_datetime(data_frame.datetime)
            except pandas.errors.OutOfBoundsDatetime:
                pass
        elif 'timestamp' in data_frame:
            try:
                data_frame['datetime'] = pandas.to_datetime(
                    data_frame.timestamp / 1e6, utc=True, unit='s')
            except pandas.errors.OutOfBoundsDatetime:
                pass

        return data_frame
def to_pandas ( self ) : if not self . _raw_response : self . _execute_query ( ) return_list = [ ] timelines = { t . id : t . name for t in self . _sketch . list_timelines ( ) } return_field_list = [ ] return_fields = self . _return_fields if return_fields : if return_fields . startswith ( '\'' ) : return_fields = return_fields [ 1 : ] if return_fields . endswith ( '\'' ) : return_fields = return_fields [ : - 1 ] return_field_list = return_fields . split ( ',' ) for result in self . _raw_response . get ( 'objects' , [ ] ) : source = result . get ( '_source' , { } ) if not return_fields or '_id' in return_field_list : source [ '_id' ] = result . get ( '_id' ) if not return_fields or '_type' in return_field_list : source [ '_type' ] = result . get ( '_type' ) if not return_fields or '_index' in return_field_list : source [ '_index' ] = result . get ( '_index' ) if not return_fields or '_source' in return_field_list : source [ '_source' ] = timelines . get ( result . get ( '__ts_timeline_id' ) ) if not return_fields or '__ts_timeline_id' in return_field_list : source [ '_source' ] = timelines . get ( result . get ( '__ts_timeline_id' ) ) return_list . append ( source ) data_frame = pandas . DataFrame ( return_list ) if 'datetime' in data_frame : try : data_frame [ 'datetime' ] = pandas . to_datetime ( data_frame . datetime ) except pandas . errors . OutOfBoundsDatetime : pass elif 'timestamp' in data_frame : try : data_frame [ 'datetime' ] = pandas . to_datetime ( data_frame . timestamp / 1e6 , utc = True , unit = 's' ) except pandas . errors . OutOfBoundsDatetime : pass return data_frame