(self, file_name='', count=False)
Execute a search request and store the results.

        Args:
            file_name (str): optional file path to a filename that
                all the results will be saved to. If not provided
                the results will be stored in the search object.
            count (bool): optional boolean that determines whether
                we want to execute the query or only count the
                number of events that the query would produce.
Execute a search request and store the results.
Execute a search request and store the results .
def _execute_query(self, file_name='', count=False):
        """Execute a search request and store the results.

        Args:
            file_name (str): optional file path to a filename that
                all the results will be saved to. If not provided
                the results will be stored in the search object.
            count (bool): optional boolean that determines whether
                we want to execute the query or only count the
                number of events that the query would produce.
        """
        query_filter = self.query_filter
        if not isinstance(query_filter, dict):
            raise ValueError(
                'Unable to query with a query filter that isn\'t a dict.')

        stop_size = self._max_entries
        scrolling = not bool(stop_size and (
            stop_size < self.DEFAULT_SIZE_LIMIT))

        if self.scrolling is not None:
            scrolling = self.scrolling

        form_data = {
            'query': self._query_string,
            'filter': query_filter,
            'dsl': self._query_dsl,
            'count': count,
            'fields': self._return_fields,
            'enable_scroll': scrolling,
            'file_name': file_name,
        }

        response = self.api.session.post(
            f'{self.api.api_root}/{self.resource_uri}', json=form_data)
        if not error.check_return_status(response, logger):
            error.error_message(
                response, message='Unable to query results',
                error=ValueError)

        if file_name:
            with open(file_name, 'wb') as fw:
                fw.write(response.content)
            return

        response_json = error.get_response_json(response, logger)

        if count:
            meta = response_json.get('meta', {})
            self._total_elastic_size = meta.get('total_count', 0)
            return

        scroll_id = response_json.get('meta', {}).get('scroll_id', '')
        form_data['scroll_id'] = scroll_id

        count = len(response_json.get('objects', []))
        total_count = count
        while count > 0:
            if self._max_entries and total_count >= self._max_entries:
                break

            if not scroll_id:
                logger.debug('No scroll ID, will stop.')
                break

            more_response = self.api.session.post(
                f'{self.api.api_root}/{self.resource_uri}', json=form_data)
            if not error.check_return_status(more_response, logger):
                error.error_message(
                    response, message='Unable to query results',
                    error=ValueError)
            more_response_json = error.get_response_json(more_response, logger)
            count = len(more_response_json.get('objects', []))
            total_count += count
            response_json['objects'].extend(
                more_response_json.get('objects', []))
            more_meta = more_response_json.get('meta', {})
            added_time = more_meta.get('es_time', 0)
            response_json['meta']['es_time'] += added_time

        self._total_elastic_size = response_json.get(
            'meta', {}).get('es_total_count', 0)
        if self._total_elastic_size != total_count:
            logger.info(
                '%d results were returned, but '
                '%d records matched the search query',
                total_count, self._total_elastic_size)

        self._raw_response = response_json
def _execute_query ( self , file_name = '' , count = False ) : query_filter = self . query_filter if not isinstance ( query_filter , dict ) : raise ValueError ( 'Unable to query with a query filter that isn\'t a dict.' ) stop_size = self . _max_entries scrolling = not bool ( stop_size and ( stop_size < self . DEFAULT_SIZE_LIMIT ) ) if self . scrolling is not None : scrolling = self . scrolling form_data = { 'query' : self . _query_string , 'filter' : query_filter , 'dsl' : self . _query_dsl , 'count' : count , 'fields' : self . _return_fields , 'enable_scroll' : scrolling , 'file_name' : file_name , } response = self . api . session . post ( f'{self.api.api_root}/{self.resource_uri}' , json = form_data ) if not error . check_return_status ( response , logger ) : error . error_message ( response , message = 'Unable to query results' , error = ValueError ) if file_name : with open ( file_name , 'wb' ) as fw : fw . write ( response . content ) return response_json = error . get_response_json ( response , logger ) if count : meta = response_json . get ( 'meta' , { } ) self . _total_elastic_size = meta . get ( 'total_count' , 0 ) return scroll_id = response_json . get ( 'meta' , { } ) . get ( 'scroll_id' , '' ) form_data [ 'scroll_id' ] = scroll_id count = len ( response_json . get ( 'objects' , [ ] ) ) total_count = count while count > 0 : if self . _max_entries and total_count >= self . _max_entries : break if not scroll_id : logger . debug ( 'No scroll ID, will stop.' ) break more_response = self . api . session . post ( f'{self.api.api_root}/{self.resource_uri}' , json = form_data ) if not error . check_return_status ( more_response , logger ) : error . error_message ( response , message = 'Unable to query results' , error = ValueError ) more_response_json = error . get_response_json ( more_response , logger ) count = len ( more_response_json . get ( 'objects' , [ ] ) ) total_count += count response_json [ 'objects' ] . extend ( more_response_json . get ( 'objects' , [ ] ) ) more_meta = more_response_json . get ( 'meta' , { } ) added_time = more_meta . get ( 'es_time' , 0 ) response_json [ 'meta' ] [ 'es_time' ] += added_time self . _total_elastic_size = response_json . get ( 'meta' , { } ) . get ( 'es_total_count' , 0 ) if self . _total_elastic_size != total_count : logger . info ( '%d results were returned, but ' '%d records matched the search query' , total_count , self . _total_elastic_size ) self . _raw_response = response_json