import org.graylog2.plugin.indexer.searches.timeranges.AbsoluteRange; //导入依赖的package包/类
protected org.graylog2.plugin.indexer.searches.timeranges.TimeRange restrictTimeRange(
        final org.graylog2.plugin.indexer.searches.timeranges.TimeRange timeRange) {
    final DateTime originalFrom = timeRange.getFrom();
    final DateTime to = timeRange.getTo();
    final DateTime from;

    final SearchesClusterConfig config = clusterConfigService.get(SearchesClusterConfig.class);

    if (config == null || Period.ZERO.equals(config.queryTimeRangeLimit())) {
        from = originalFrom;
    } else {
        final DateTime limitedFrom = to.minus(config.queryTimeRangeLimit());
        from = limitedFrom.isAfter(originalFrom) ? limitedFrom : originalFrom;
    }

    return AbsoluteRange.create(from, to);
}
 

import org.graylog2.plugin.indexer.searches.timeranges.AbsoluteRange; //导入依赖的package包/类
@POST
@Timed
@ApiOperation(value = "Get map data")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@NoAuditEvent("only used to fetch map data, no changes made in the system")
public MapDataSearchResult mapData(@ApiParam(name = "JSON body", required = true) MapDataSearchRequest request) {
    final String filter = "streams:" + request.streamId();

    switch (request.timerange().type()) {
        case AbsoluteRange.ABSOLUTE:
            checkSearchPermission(filter, RestPermissions.SEARCHES_ABSOLUTE);
            break;
        case RelativeRange.RELATIVE:
            checkSearchPermission(filter, RestPermissions.SEARCHES_RELATIVE);
            break;
        case KeywordRange.KEYWORD:
            checkSearchPermission(filter, RestPermissions.SEARCHES_KEYWORD);
            break;
    }

    try {
        return search.searchMapData(request);
    } catch (MapDataSearch.ValueTypeException e) {
        LOG.error("Map data query failed: {}", e.getMessage());
        throw new BadRequestException(e.getMessage());
    }
}
 

import org.graylog2.plugin.indexer.searches.timeranges.AbsoluteRange; //导入依赖的package包/类
@Override
  public CheckResult runCheck() {        
      String filter = "streams:" + stream.getId();
      Integer backlogSize = getBacklog();
      boolean backlogEnabled = false;
      int searchLimit = 1;

      if(backlogSize != null && backlogSize > 0) {
          backlogEnabled = true;
          searchLimit = backlogSize;
      }

      SearchResult result = searches.search(
    query,
    filter,
    AbsoluteRange.create(Tools.nowUTC().minus(Minutes.minutes(backtime)).minus(Minutes.minutes(staytime)), Tools.nowUTC().minus(Minutes.minutes(backtime))),
    searchLimit,
    0,
    new Sorting(Message.FIELD_TIMESTAMP, Sorting.Direction.DESC)
);

final List<MessageSummary> summaries;
if (backlogEnabled) {
    summaries = Lists.newArrayListWithCapacity(result.getResults().size());
    for (ResultMessage resultMessage : result.getResults()) {
        final Message msg = resultMessage.getMessage();
        summaries.add(new MessageSummary(resultMessage.getIndex(), msg));
    }
} else {
    summaries = Collections.emptyList();
}

final long count = result.getTotalResults();

final String resultDescription = "Stream received messages matching <" + query + "> "
    + "(Current grace time: " + grace + " minutes)";

if (count > 0) {
    LOG.debug("Alert check <{}> found [{}] messages.", id, count);
    return new CheckResult(true, this, resultDescription, Tools.nowUTC(), summaries);
} else {
    LOG.debug("Alert check <{}> returned no results.", id);
    return new NegativeCheckResult();
}
  }