mirror of
https://github.com/marcredhat/kql
synced 2026-06-08 13:23:58 +00:00
marc
61 lines
1.9 KiB
Python
61 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""Compare the EXACT addEvents payload used by ingest_jsonl with a known-good
|
|
manual one. Add a unique probe marker so we can tell whether it actually
|
|
landed in SDL."""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import sys
|
|
import time
|
|
import uuid
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT))
|
|
|
|
from harness.sdl_client import add_events, power_query, _clean_attrs # noqa: E402
|
|
|
|
JSONL = ROOT / "sample_data" / "events.jsonl"
|
|
PROBE = uuid.uuid4().hex[:8]
|
|
|
|
# Take the first 3 lines of JSONL, decorate with probe, send via the SAME
|
|
# code path as ingest_jsonl does (but inlined here so we can print everything).
|
|
events = []
|
|
with JSONL.open() as f:
|
|
for line in f:
|
|
if len(events) >= 3:
|
|
break
|
|
rec = json.loads(line)
|
|
rec["probe"] = f"{PROBE}_{len(events)}"
|
|
ts_ms = int(rec["ts_epoch_ms"])
|
|
attrs = _clean_attrs(rec)
|
|
events.append({"ts": str(ts_ms * 1_000_000), "sev": 3,
|
|
"thread": "T1", "attrs": attrs})
|
|
|
|
print(f"=== Payload ({len(events)} events) ===")
|
|
print(json.dumps(events, indent=2, default=str)[:3000])
|
|
print()
|
|
print(f"=== Submitting (probe prefix={PROBE}) ===")
|
|
r = add_events(events)
|
|
print(f"addEvents -> {json.dumps(r)}")
|
|
|
|
print("\nWaiting 12 s for indexing ...")
|
|
time.sleep(12)
|
|
|
|
q = f"probe contains '{PROBE}' | columns event_type, probe, ts_epoch_ms | limit 10"
|
|
print(f"\nQuery: {q}")
|
|
res = power_query(q, "10m")
|
|
print(f"Result -> matching={res.get('matchingEvents')}")
|
|
for row in res.get("values") or []:
|
|
print(" ", row)
|
|
|
|
# Also: show TS skew vs real now
|
|
import datetime as dt
|
|
real_now_ms = int(time.time() * 1000)
|
|
print(f"\nreal_now_ms = {real_now_ms}")
|
|
for e in events:
|
|
ts_ns = int(e["ts"])
|
|
ts_ms = ts_ns // 1_000_000
|
|
age_min = (real_now_ms - ts_ms) / 60000
|
|
print(f" event ts_ms={ts_ms} age={age_min:.2f} min attrs.event_type={e['attrs']['event_type']}")
|