(
            self, query_string=None, query_filter=None, query_dsl=None,
            indices=None, return_fields=None)
return pandas.DataFrame(events)
Search OpenSearch.

        Args:
            query_string: Query string.
            query_filter: Dictionary containing filters to apply.
            query_dsl: Dictionary containing OpenSearch DSL query.
            indices: List of indices to query.
            return_fields: List of fields to be included in the search results,
                if not included all fields will be included in the results.

        Returns:
            A python pandas object with all the events.

        Raises:
            ValueError: if neither query_string or query_dsl is provided.
Search OpenSearch.
Search OpenSearch .
def event_pandas(
            self, query_string=None, query_filter=None, query_dsl=None,
            indices=None, return_fields=None):
        """Search OpenSearch.

        Args:
            query_string: Query string.
            query_filter: Dictionary containing filters to apply.
            query_dsl: Dictionary containing OpenSearch DSL query.
            indices: List of indices to query.
            return_fields: List of fields to be included in the search results,
                if not included all fields will be included in the results.

        Returns:
            A python pandas object with all the events.

        Raises:
            ValueError: if neither query_string or query_dsl is provided.
        """
        if not (query_string or query_dsl):
            raise ValueError('Both query_string and query_dsl are missing')

        if not query_filter:
            query_filter = {'indices': self.index_name, 'size': 10000}

        if not indices:
            indices = [self.index_name]

        if self.timeline_id:
            timeline_ids = [self.timeline_id]
        else:
            timeline_ids = None

        # Refresh the index to make sure it is searchable.
        for index in indices:
            try:
                self.datastore.client.indices.refresh(index=index)
            except opensearchpy.NotFoundError:
                logger.error(
                    'Unable to refresh index: {0:s}, not found, '
                    'removing from list.'.format(index))
                broken_index = indices.index(index)
                _ = indices.pop(broken_index)

        if not indices:
            raise ValueError('Unable to get events, no indices to query.')

        if return_fields:
            default_fields = definitions.DEFAULT_SOURCE_FIELDS
            return_fields.extend(default_fields)
            return_fields = list(set(return_fields))
            return_fields = ','.join(return_fields)

        results = self.datastore.search_stream(
            sketch_id=self.sketch.id,
            query_string=query_string,
            query_filter=query_filter,
            query_dsl=query_dsl,
            indices=indices,
            timeline_ids=timeline_ids,
            return_fields=return_fields,
        )

        events = []
        for event in results:
            source = event.get('_source')
            source['_id'] = event.get('_id')
            source['_type'] = event.get('_type')
            source['_index'] = event.get('_index')
            events.append(source)

        return pandas.DataFrame(events)
def event_pandas ( self , query_string = None , query_filter = None , query_dsl = None , indices = None , return_fields = None ) : if not ( query_string or query_dsl ) : raise ValueError ( 'Both query_string and query_dsl are missing' ) if not query_filter : query_filter = { 'indices' : self . index_name , 'size' : 10000 } if not indices : indices = [ self . index_name ] if self . timeline_id : timeline_ids = [ self . timeline_id ] else : timeline_ids = None # Refresh the index to make sure it is searchable. for index in indices : try : self . datastore . client . indices . refresh ( index = index ) except opensearchpy . NotFoundError : logger . error ( 'Unable to refresh index: {0:s}, not found, ' 'removing from list.' . format ( index ) ) broken_index = indices . index ( index ) _ = indices . pop ( broken_index ) if not indices : raise ValueError ( 'Unable to get events, no indices to query.' ) if return_fields : default_fields = definitions . DEFAULT_SOURCE_FIELDS return_fields . extend ( default_fields ) return_fields = list ( set ( return_fields ) ) return_fields = ',' . join ( return_fields ) results = self . datastore . search_stream ( sketch_id = self . sketch . id , query_string = query_string , query_filter = query_filter , query_dsl = query_dsl , indices = indices , timeline_ids = timeline_ids , return_fields = return_fields , ) events = [ ] for event in results : source = event . get ( '_source' ) source [ '_id' ] = event . get ( '_id' ) source [ '_type' ] = event . get ( '_type' ) source [ '_index' ] = event . get ( '_index' ) events . append ( source ) return pandas . DataFrame ( events )