| 1 | from typing import Any |
| 2 | from typing import Dict |
| 3 | from typing import List |
| 4 | from typing import Optional |
| 5 | |
| 6 | from pydantic import BaseModel |
| 7 | from pydantic import Field |
| 8 | |
| 9 | |
| 10 | class EventsQueryParams(BaseModel): |
| 11 | timerange: str = Field("24h", description="Time range (e.g. '1h', '24h', '7d', '1w')") |
| 12 | page_size: int = Field(50, ge=1, le=1000, description="Number of results per page") |
| 13 | scroll_id: Optional[str] = Field(None, description="Scroll ID for fetching the next page") |
| 14 | query: Optional[str] = Field(None, description="Lucene query string (e.g. 'agent_name:piHole AND agent_id:088')") |
| 15 | time_from: Optional[str] = Field( |
| 16 | None, |
| 17 | description="Absolute start time in ISO format (e.g. '2025-01-01T00:00:00Z'). Overrides timerange.", |
| 18 | ) |
| 19 | time_to: Optional[str] = Field(None, description="Absolute end time in ISO format (e.g. '2025-01-31T23:59:59Z'). Overrides timerange.") |
| 20 | |
| 21 | |
| 22 | class EventsQueryResponse(BaseModel): |
| 23 | events: List[Dict[str, Any]] |
| 24 | total: int |
| 25 | scroll_id: Optional[str] = None |
| 26 | page_size: int |
| 27 | success: bool |
| 28 | message: str |
| 29 | |
| 30 | |
| 31 | class FieldMapping(BaseModel): |
| 32 | field: str = Field(..., description="Field name (e.g. 'agent_name', 'agent_id')") |
| 33 | type: str = Field(..., description="OpenSearch field type (e.g. 'keyword', 'text', 'long', 'date')") |
| 34 | |
| 35 | |
| 36 | class FieldMappingsResponse(BaseModel): |
| 37 | fields: List[FieldMapping] |
| 38 | total: int |
| 39 | index_pattern: str |
| 40 | success: bool |
| 41 | message: str |