Использование Elasticsearch для временных рядов данных

resp = client.cluster.put_component_template(
    name="my-mappings",
    template={
        "mappings": {
            "properties": {
                "@timestamp": {
                    "type": "date",
                    "format": "date_optional_time||epoch_millis"
                },
                "message": {
                    "type": "wildcard"
                }
            }
        }
    },
    meta={
        "description": "Mappings for @timestamp and message fields",
        "my-custom-meta-field": "More arbitrary metadata"
    },
)
print(resp)

resp1 = client.cluster.put_component_template(
    name="my-settings",
    template={
        "settings": {
            "index.lifecycle.name": "my-lifecycle-policy"
        }
    },
    meta={
        "description": "Settings for ILM",
        "my-custom-meta-field": "More arbitrary metadata"
    },
)
print(resp1)

resp = client.indices.put_index_template(
    name="my-index-template",
    index_patterns=[
        "my-data-stream*"
    ],
    data_stream={},
    composed_of=[
        "my-mappings",
        "my-settings"
    ],
    priority=500,
    meta={
        "description": "Template for my time series data",
        "my-custom-meta-field": "More arbitrary metadata"
    },
)
print(resp)

resp = client.bulk(
    index="my-data-stream",
    operations=[
        {
            "create": {}
        },
        {
            "@timestamp": "2099-05-06T16:21:15.000Z",
            "message": "192.0.2.42 - - [06/May/2099:16:21:15 +0000] \"GET /images/bg.jpg HTTP/1.0\" 200 24736"
        },
        {
            "create": {}
        },
        {
            "@timestamp": "2099-05-06T16:25:42.000Z",
            "message": "192.0.2.255 - - [06/May/2099:16:25:42 +0000] \"GET /favicon.ico HTTP/1.0\" 200 3638"
        }
    ],
)
print(resp)

resp1 = client.index(
    index="my-data-stream",
    document={
        "@timestamp": "2099-05-06T16:21:15.000Z",
        "message": "192.0.2.42 - - [06/May/2099:16:21:15 +0000] \"GET /images/bg.jpg HTTP/1.0\" 200 24736"
    },
)
print(resp1)

resp = client.search(
    index="my-data-stream",
    runtime_mappings={
        "source.ip": {
            "type": "ip",
            "script": "\n        String sourceip=grok('%{IPORHOST:sourceip} .*').extract(doc[ \"message\" ].value)?.sourceip;\n        if (sourceip != null) emit(sourceip);\n      "
        }
    },
    query={
        "bool": {
            "filter": [
                {
                    "range": {
                        "@timestamp": {
                            "gte": "now-1d/d",
                            "lt": "now/d"
                        }
                    }
                },
                {
                    "range": {
                        "source.ip": {
                            "gte": "192.0.2.0",
                            "lte": "192.0.2.255"
                        }
                    }
                }
            ]
        }
    },
    fields=[
        "*"
    ],
    source=False,
    sort=[
        {
            "@timestamp": "desc"
        },
        {
            "source.ip": "desc"
        }
    ],
)
print(resp)

resp = client.async_search.submit(
    index="my-data-stream",
    runtime_mappings={
        "source.ip": {
            "type": "ip",
            "script": "\n        String sourceip=grok('%{IPORHOST:sourceip} .*').extract(doc[ \"message\" ].value)?.sourceip;\n        if (sourceip != null) emit(sourceip);\n      "
        }
    },
    query={
        "bool": {
            "filter": [
                {
                    "range": {
                        "@timestamp": {
                            "gte": "now-2y/d",
                            "lt": "now/d"
                        }
                    }
                },
                {
                    "range": {
                        "source.ip": {
                            "gte": "192.0.2.0",
                            "lte": "192.0.2.255"
                        }
                    }
                }
            ]
        }
    },
    fields=[
        "*"
    ],
    source=False,
    sort=[
        {
            "@timestamp": "desc"
        },
        {
            "source.ip": "desc"
        }
    ],
)
print(resp)