# Path: elastalert/util.py
# class EAException(Exception):
#     pass
# 
# Path: elastalert/util.py
# def lookup_es_key(lookup_dict, term):
#     """ Performs iterative dictionary search for the given term.
#     :returns: The value identified by term or None if it cannot be found.
#     """
#     value_dict, value_key = _find_es_dict_by_key(lookup_dict, term)
#     return None if value_key is None else value_dict[value_key]
# 
# Path: elastalert/util.py
# def ts_add(ts, td):
#     """ Allows a timedelta (td) add operation on a string timestamp (ts) """
#     return dt_to_ts(ts_to_dt(ts) + td)


import datetime
import logging
import json
import os.path
import prison
import urllib.parse
from .util import EAException
from .util import lookup_es_key
from .util import ts_add
        },
        'time': {
            'from': from_time,
            'to': to_time
        }
    } )


def kibana_discover_app_state(index, columns, filters, query_keys, match):
    app_filters = []

    if filters:
        bool_filter = { 'must': filters }
        app_filters.append( {
            '$state': {
                'store': 'appState'
            },
            'bool': bool_filter,
            'meta': {
                'alias': 'filter',
                'disabled': False,
                'index': index,
                'key': 'bool',
                'negate': False,
                'type': 'custom',
                'value': json.dumps(bool_filter, separators=(',', ':'))
            },
        } )

    for query_key in query_keys:

# Path: elastalert/util.py
# class EAException(Exception):
#     pass
# 
# Path: elastalert/util.py
# def lookup_es_key(lookup_dict, term):
#     """ Performs iterative dictionary search for the given term.
#     :returns: The value identified by term or None if it cannot be found.
#     """
#     value_dict, value_key = _find_es_dict_by_key(lookup_dict, term)
#     return None if value_key is None else value_dict[value_key]
# 
# Path: elastalert/util.py
# def ts_add(ts, td):
#     """ Allows a timedelta (td) add operation on a string timestamp (ts) """
#     return dt_to_ts(ts_to_dt(ts) + td)


# Path: elastalert/kibana_discover.py
import datetime
import logging
import json
import os.path
import prison
import urllib.parse
from .util import EAException
from .util import lookup_es_key
from .util import ts_add

        },
        'time': {
            'from': from_time,
            'to': to_time
        }
    } )


def kibana_discover_app_state(index, columns, filters, query_keys, match):
    app_filters = []

    if filters:
        bool_filter = { 'must': filters }
        app_filters.append( {
            '$state': {
                'store': 'appState'
            },
            'bool': bool_filter,
            'meta': {
                'alias': 'filter',
                'disabled': False,
                'index': index,
                'key': 'bool',
                'negate': False,
                'type': 'custom',
                'value': json.dumps(bool_filter, separators=(',', ':'))
            },
        } )

    for query_key in query_keys:

        query_value = lookup_es_key(match, query_key)