# Path: elastalert/util.py
# class EAException(Exception):
#     pass
# 
# Path: elastalert/util.py
# def lookup_es_key(lookup_dict, term):
#     """ Performs iterative dictionary search for the given term.
#     :returns: The value identified by term or None if it cannot be found.
#     """
#     value_dict, value_key = _find_es_dict_by_key(lookup_dict, term)
#     return None if value_key is None else value_dict[value_key]
# 
# Path: elastalert/util.py
# def ts_add(ts, td):
#     """ Allows a timedelta (td) add operation on a string timestamp (ts) """
#     return dt_to_ts(ts_to_dt(ts) + td)


import datetime
import logging
import json
import os.path
import prison
import urllib.parse
from .util import EAException
from .util import lookup_es_key
from .util import ts_add
    if not kibana_version:
        logging.warning(
            'Missing kibana_discover_version for rule %s' % (
                rule.get('name', '<MISSING NAME>')
            )
        )
        return None

    index = rule.get('kibana_discover_index_pattern_id')
    if not index:
        logging.warning(
            'Missing kibana_discover_index_pattern_id for rule %s' % (
                rule.get('name', '<MISSING NAME>')
            )
        )
        return None

    columns = rule.get('kibana_discover_columns', ['_source'])
    filters = rule.get('filter', [])

    if 'query_key' in rule:
        query_keys = rule.get('compound_query_key', [rule['query_key']])
    else:
        query_keys = []

    timestamp = lookup_es_key(match, rule['timestamp_field'])
    timeframe = rule.get('timeframe', kibana_default_timedelta)
    from_timedelta = rule.get('kibana_discover_from_timedelta', timeframe)
    from_time = ts_add(timestamp, -from_timedelta)
    to_timedelta = rule.get('kibana_discover_to_timedelta', timeframe)

# Path: elastalert/util.py
# class EAException(Exception):
#     pass
# 
# Path: elastalert/util.py
# def lookup_es_key(lookup_dict, term):
#     """ Performs iterative dictionary search for the given term.
#     :returns: The value identified by term or None if it cannot be found.
#     """
#     value_dict, value_key = _find_es_dict_by_key(lookup_dict, term)
#     return None if value_key is None else value_dict[value_key]
# 
# Path: elastalert/util.py
# def ts_add(ts, td):
#     """ Allows a timedelta (td) add operation on a string timestamp (ts) """
#     return dt_to_ts(ts_to_dt(ts) + td)


# Path: elastalert/kibana_discover.py
import datetime
import logging
import json
import os.path
import prison
import urllib.parse
from .util import EAException
from .util import lookup_es_key
from .util import ts_add

    if not kibana_version:
        logging.warning(
            'Missing kibana_discover_version for rule %s' % (
                rule.get('name', '<MISSING NAME>')
            )
        )
        return None

    index = rule.get('kibana_discover_index_pattern_id')
    if not index:
        logging.warning(
            'Missing kibana_discover_index_pattern_id for rule %s' % (
                rule.get('name', '<MISSING NAME>')
            )
        )
        return None

    columns = rule.get('kibana_discover_columns', ['_source'])
    filters = rule.get('filter', [])

    if 'query_key' in rule:
        query_keys = rule.get('compound_query_key', [rule['query_key']])
    else:
        query_keys = []

    timestamp = lookup_es_key(match, rule['timestamp_field'])
    timeframe = rule.get('timeframe', kibana_default_timedelta)
    from_timedelta = rule.get('kibana_discover_from_timedelta', timeframe)
    from_time = ts_add(timestamp, -from_timedelta)
    to_timedelta = rule.get('kibana_discover_to_timedelta', timeframe)

    to_time = ts_add(timestamp, to_timedelta)