# Path: elastalert/enhancements.py
# class BaseEnhancement(object):
#     """ Enhancements take a match dictionary object and modify it in some way to
#     enhance an alert. These are specified in each rule under the match_enhancements option.
#     Generally, the key value pairs in the match module will be contained in the alert body. """
# 
#     def __init__(self, rule):
#         self.rule = rule
# 
#     def process(self, match):
#         """ Modify the contents of match, a dictionary, in some way """
#         raise NotImplementedError()
# 
# Path: elastalert/enhancements.py
# class DropMatchException(Exception):
#     """ ElastAlert will drop a match if this exception type is raised by an enhancement """
#     pass
# 
# Path: elastalert/kibana.py
# def set_time(dashboard, start, end):
# def set_index_name(dashboard, name):
# def set_timestamp_field(dashboard, field):
# def add_filter(dashboard, es_filter):
# def set_name(dashboard, name):
# def set_included_fields(dashboard, fields):
# def filters_from_dashboard(db):
# def kibana4_dashboard_link(dashboard, starttime, endtime):
# 
# Path: elastalert/util.py
# def dt_to_ts(dt):
#     if not isinstance(dt, datetime.datetime):
#         logging.warning('Expected datetime, got %s' % (type(dt)))
#         return dt
#     ts = dt.isoformat()
#     # Round microseconds to milliseconds
#     if dt.tzinfo is None:
#         # Implicitly convert local times to UTC
#         return ts + 'Z'
#     # isoformat() uses microsecond accuracy and timezone offsets
#     # but we should try to use millisecond accuracy and Z to indicate UTC
#     return ts.replace('000+00:00', 'Z').replace('+00:00', 'Z')
# 
# Path: elastalert/util.py
# def dt_to_unix(dt):
#     return int(total_seconds(dt - datetime.datetime(1970, 1, 1, tzinfo=dateutil.tz.tzutc())))
# 
# Path: elastalert/util.py
# def dt_to_unixms(dt):
#     return int(dt_to_unix(dt) * 1000)
# 
# Path: elastalert/util.py
# class EAException(Exception):
#     pass
# 
# Path: elastalert/util.py
# def ts_now():
#     return datetime.datetime.utcnow().replace(tzinfo=dateutil.tz.tzutc())
# 
# Path: elastalert/util.py
# def ts_to_dt(timestamp):
#     if isinstance(timestamp, datetime.datetime):
#         return timestamp
#     dt = dateutil.parser.parse(timestamp)
#     # Implicitly convert local timestamps to UTC
#     if dt.tzinfo is None:
#         dt = dt.replace(tzinfo=pytz.utc)
#     return dt
# 
# Path: elastalert/util.py
# def unix_to_dt(ts):
#     dt = datetime.datetime.utcfromtimestamp(float(ts))
#     dt = dt.replace(tzinfo=dateutil.tz.tzutc())
#     return dt


import copy
import datetime
import json
import threading
import elasticsearch
import mock
import pytest
from elasticsearch.exceptions import ConnectionError
from elasticsearch.exceptions import ElasticsearchException
from elastalert.enhancements import BaseEnhancement
from elastalert.enhancements import DropMatchException
from elastalert.kibana import dashboard_temp
from elastalert.util import dt_to_ts
from elastalert.util import dt_to_unix
from elastalert.util import dt_to_unixms
from elastalert.util import EAException
from elastalert.util import ts_now
from elastalert.util import ts_to_dt
from elastalert.util import unix_to_dt
    ea_sixsix.thread_data.current_es.search.return_value = {'hits': {'total': 0, 'hits': []}}
    ea_sixsix.run_query(ea_sixsix.rules[0], START, END)
    ea_sixsix.thread_data.current_es.search.assert_called_with(body={
        'query': {'bool': {
            'filter': {'bool': {'must': [{'range': {'@timestamp': {'lte': END_TIMESTAMP, 'gt': START_TIMESTAMP}}}]}}}},
        'sort': [{'@timestamp': {'order': 'asc'}}], 'stored_fields': ['@timestamp']}, index='idx',
        ignore_unavailable=True,
        size=ea_sixsix.rules[0]['max_query_size'], scroll=ea_sixsix.conf['scroll_keepalive'])


def test_query_with_unix(ea):
    ea.rules[0]['timestamp_type'] = 'unix'
    ea.rules[0]['dt_to_ts'] = dt_to_unix
    ea.thread_data.current_es.search.return_value = {'hits': {'total': 0, 'hits': []}}
    ea.run_query(ea.rules[0], START, END)
    start_unix = dt_to_unix(START)
    end_unix = dt_to_unix(END)
    ea.thread_data.current_es.search.assert_called_with(
        body={'query': {'filtered': {
            'filter': {'bool': {'must': [{'range': {'@timestamp': {'lte': end_unix, 'gt': start_unix}}}]}}}},
            'sort': [{'@timestamp': {'order': 'asc'}}]}, index='idx', _source_include=['@timestamp'],
        ignore_unavailable=True,
        size=ea.rules[0]['max_query_size'], scroll=ea.conf['scroll_keepalive'])


def test_query_sixsix_with_unix(ea_sixsix):
    ea_sixsix.rules[0]['timestamp_type'] = 'unix'
    ea_sixsix.rules[0]['dt_to_ts'] = dt_to_unix
    ea_sixsix.thread_data.current_es.search.return_value = {'hits': {'total': 0, 'hits': []}}
    ea_sixsix.run_query(ea_sixsix.rules[0], START, END)

# Path: elastalert/enhancements.py
# class BaseEnhancement(object):
#     """ Enhancements take a match dictionary object and modify it in some way to
#     enhance an alert. These are specified in each rule under the match_enhancements option.
#     Generally, the key value pairs in the match module will be contained in the alert body. """
# 
#     def __init__(self, rule):
#         self.rule = rule
# 
#     def process(self, match):
#         """ Modify the contents of match, a dictionary, in some way """
#         raise NotImplementedError()
# 
# Path: elastalert/enhancements.py
# class DropMatchException(Exception):
#     """ ElastAlert will drop a match if this exception type is raised by an enhancement """
#     pass
# 
# Path: elastalert/kibana.py
# def set_time(dashboard, start, end):
# def set_index_name(dashboard, name):
# def set_timestamp_field(dashboard, field):
# def add_filter(dashboard, es_filter):
# def set_name(dashboard, name):
# def set_included_fields(dashboard, fields):
# def filters_from_dashboard(db):
# def kibana4_dashboard_link(dashboard, starttime, endtime):
# 
# Path: elastalert/util.py
# def dt_to_ts(dt):
#     if not isinstance(dt, datetime.datetime):
#         logging.warning('Expected datetime, got %s' % (type(dt)))
#         return dt
#     ts = dt.isoformat()
#     # Round microseconds to milliseconds
#     if dt.tzinfo is None:
#         # Implicitly convert local times to UTC
#         return ts + 'Z'
#     # isoformat() uses microsecond accuracy and timezone offsets
#     # but we should try to use millisecond accuracy and Z to indicate UTC
#     return ts.replace('000+00:00', 'Z').replace('+00:00', 'Z')
# 
# Path: elastalert/util.py
# def dt_to_unix(dt):
#     return int(total_seconds(dt - datetime.datetime(1970, 1, 1, tzinfo=dateutil.tz.tzutc())))
# 
# Path: elastalert/util.py
# def dt_to_unixms(dt):
#     return int(dt_to_unix(dt) * 1000)
# 
# Path: elastalert/util.py
# class EAException(Exception):
#     pass
# 
# Path: elastalert/util.py
# def ts_now():
#     return datetime.datetime.utcnow().replace(tzinfo=dateutil.tz.tzutc())
# 
# Path: elastalert/util.py
# def ts_to_dt(timestamp):
#     if isinstance(timestamp, datetime.datetime):
#         return timestamp
#     dt = dateutil.parser.parse(timestamp)
#     # Implicitly convert local timestamps to UTC
#     if dt.tzinfo is None:
#         dt = dt.replace(tzinfo=pytz.utc)
#     return dt
# 
# Path: elastalert/util.py
# def unix_to_dt(ts):
#     dt = datetime.datetime.utcfromtimestamp(float(ts))
#     dt = dt.replace(tzinfo=dateutil.tz.tzutc())
#     return dt


# Path: tests/base_test.py
import copy
import datetime
import json
import threading
import elasticsearch
import mock
import pytest
from elasticsearch.exceptions import ConnectionError
from elasticsearch.exceptions import ElasticsearchException
from elastalert.enhancements import BaseEnhancement
from elastalert.enhancements import DropMatchException
from elastalert.kibana import dashboard_temp
from elastalert.util import dt_to_ts
from elastalert.util import dt_to_unix
from elastalert.util import dt_to_unixms
from elastalert.util import EAException
from elastalert.util import ts_now
from elastalert.util import ts_to_dt
from elastalert.util import unix_to_dt

    ea_sixsix.thread_data.current_es.search.return_value = {'hits': {'total': 0, 'hits': []}}
    ea_sixsix.run_query(ea_sixsix.rules[0], START, END)
    ea_sixsix.thread_data.current_es.search.assert_called_with(body={
        'query': {'bool': {
            'filter': {'bool': {'must': [{'range': {'@timestamp': {'lte': END_TIMESTAMP, 'gt': START_TIMESTAMP}}}]}}}},
        'sort': [{'@timestamp': {'order': 'asc'}}], 'stored_fields': ['@timestamp']}, index='idx',
        ignore_unavailable=True,
        size=ea_sixsix.rules[0]['max_query_size'], scroll=ea_sixsix.conf['scroll_keepalive'])


def test_query_with_unix(ea):
    ea.rules[0]['timestamp_type'] = 'unix'
    ea.rules[0]['dt_to_ts'] = dt_to_unix
    ea.thread_data.current_es.search.return_value = {'hits': {'total': 0, 'hits': []}}
    ea.run_query(ea.rules[0], START, END)
    start_unix = dt_to_unix(START)
    end_unix = dt_to_unix(END)
    ea.thread_data.current_es.search.assert_called_with(
        body={'query': {'filtered': {
            'filter': {'bool': {'must': [{'range': {'@timestamp': {'lte': end_unix, 'gt': start_unix}}}]}}}},
            'sort': [{'@timestamp': {'order': 'asc'}}]}, index='idx', _source_include=['@timestamp'],
        ignore_unavailable=True,
        size=ea.rules[0]['max_query_size'], scroll=ea.conf['scroll_keepalive'])


def test_query_sixsix_with_unix(ea_sixsix):
    ea_sixsix.rules[0]['timestamp_type'] = 'unix'
    ea_sixsix.rules[0]['dt_to_ts'] = dt_to_unix
    ea_sixsix.thread_data.current_es.search.return_value = {'hits': {'total': 0, 'hits': []}}
    ea_sixsix.run_query(ea_sixsix.rules[0], START, END)

    start_unix = dt_to_unix(START)