actions = []
for ob, desc in result_dic.items():
action = {
"_index": record_index,
"_type": "doc",
'_id': hashlib.md5(
(entity.get("userId") + entity.get("@timestamp")).encode("utf8")).hexdigest(),
"_source": {
'timestamp': timestamp,
'ruler': desc.split()[0],
'MonitorFrequency': "1Hour",
'object': ob,
'threshold': desc.split()[2],
'MonitorValue': desc.split()[1],
'@timestamp': desc.split()[3]+" "+desc.split()[4],
}
}
actions.append(action)
if len(actions) == 1000:
helpers.bulk(es, actions)
del actions[0:len(actions)]
if len(actions) > 0:
helpers.bulk(es, actions)
del actions[0:len(actions)]
