#NEWLINE# def mock_hits( self , rule , start , end , index ) : #NEWLINE# #INDENT# ' Mocks the effects of get_hits using global data instead of Elasticsearch. ' #NEWLINE# docs = [ ] #NEWLINE# for doc in self . data : #NEWLINE# #INDENT# if ( start <= ts_to_dt ( doc [ rule [ 'timestamp_field' ] ] ) < end ) : #NEWLINE# #INDENT# docs . append ( doc ) #NEWLINE# #UNINDENT# #UNINDENT# for doc in docs : #NEWLINE# #INDENT# fields_to_remove = [ ] #NEWLINE# for field in doc : #NEWLINE# #INDENT# if ( field != '_id' ) : #NEWLINE# #INDENT# if ( not any ( [ re . match ( incl . replace ( '*' , '.*' ) , field ) for incl in rule [ 'include' ] ] ) ) : #NEWLINE# #INDENT# fields_to_remove . append ( field ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# map ( doc . pop , fields_to_remove ) #NEWLINE# #UNINDENT# resp = [ { #NEWLINE# #INDENT# '_source' : doc , #NEWLINE# '_id' : doc [ '_id' ] , #NEWLINE# #UNINDENT# } for doc in docs ] #NEWLINE# for doc in resp : #NEWLINE# #INDENT# doc [ '_source' ] . pop ( '_id' ) #NEWLINE# #UNINDENT# ElastAlerter . process_hits ( rule , resp ) #NEWLINE# return resp