(query_dsl, timeline_ids)
return query_dsl
Build OpenSearch Search DSL query by adding in timeline filtering.

        Args:
            query_dsl: A dict with the current query_dsl
            timeline_ids: Either a list of timeline IDs (int) or None.

        Returns:
            OpenSearch query DSL as a dictionary.
Build OpenSearch Search DSL query by adding in timeline filtering.
Build OpenSearch Search DSL query by adding in timeline filtering .
def _build_query_dsl(query_dsl, timeline_ids):
        """Build OpenSearch Search DSL query by adding in timeline filtering.

        Args:
            query_dsl: A dict with the current query_dsl
            timeline_ids: Either a list of timeline IDs (int) or None.

        Returns:
            OpenSearch query DSL as a dictionary.
        """
        # Remove any aggregation coming from user supplied Query DSL.
        # We have no way to display this data in a good way today.
        if query_dsl.get('aggregations', None):
            del query_dsl['aggregations']

        if not timeline_ids:
            return query_dsl

        if not isinstance(timeline_ids, (list, tuple)):
            es_logger.error(
                'Attempting to pass in timelines to a query DSL, but the '
                'passed timelines are not a list.')
            return query_dsl

        if not all([isinstance(x, int) for x in timeline_ids]):
            es_logger.error(
                'All timeline IDs need to be an integer.')
            return query_dsl

        old_query = query_dsl.get('query')
        if not old_query:
            return query_dsl

        query_dsl['query'] = {
            'bool': {
                'must': [],
                'should': [{
                    'bool': {
                        'must': old_query,
                        'must_not': [{
                            'exists': {
                                'field': '__ts_timeline_id'},
                        }],
                    }
                }, {
                    'bool': {
                        'must': [{
                            'terms': {
                                '__ts_timeline_id': timeline_ids}
                        }, old_query],
                        'must_not': [],
                        'filter': [{
                            'exists': {
                                'field': '__ts_timeline_id'}
                        }]
                    }
                }],
                'must_not': [],
                'filter': []
            }
        }
        return query_dsl
def _build_query_dsl ( query_dsl , timeline_ids ) : # Remove any aggregation coming from user supplied Query DSL. # We have no way to display this data in a good way today. if query_dsl . get ( 'aggregations' , None ) : del query_dsl [ 'aggregations' ] if not timeline_ids : return query_dsl if not isinstance ( timeline_ids , ( list , tuple ) ) : es_logger . error ( 'Attempting to pass in timelines to a query DSL, but the ' 'passed timelines are not a list.' ) return query_dsl if not all ( [ isinstance ( x , int ) for x in timeline_ids ] ) : es_logger . error ( 'All timeline IDs need to be an integer.' ) return query_dsl old_query = query_dsl . get ( 'query' ) if not old_query : return query_dsl query_dsl [ 'query' ] = { 'bool' : { 'must' : [ ] , 'should' : [ { 'bool' : { 'must' : old_query , 'must_not' : [ { 'exists' : { 'field' : '__ts_timeline_id' } , } ] , } } , { 'bool' : { 'must' : [ { 'terms' : { '__ts_timeline_id' : timeline_ids } } , old_query ] , 'must_not' : [ ] , 'filter' : [ { 'exists' : { 'field' : '__ts_timeline_id' } } ] } } ] , 'must_not' : [ ] , 'filter' : [ ] } } return query_dsl