Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reducing the unused calls to elasticsearch_client #303

Merged
merged 2 commits into from
Jun 28, 2021

Conversation

JeffAshton
Copy link
Contributor

@JeffAshton JeffAshton commented Jun 28, 2021

Adding helper method to reduce the number of unnecessary calls to elasticsearch_client helper method.

@@ -868,7 +876,7 @@ def run_rule(self, rule, endtime, starttime=None):
:return: The number of matches that the rule produced.
"""
run_start = time.time()
self.thread_data.current_es = self.es_clients.setdefault(rule['name'], elasticsearch_client(rule))
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

setdefault results in the correct behaviour, but because it takes a concrete default value, elasticsearch_client is getting called every run and the result is disregarded. From what I see dictionary does not have a lazy option.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I see where this will help improve efficiency. I think a unit test that proves the same elasticsearch_client instance is returned from the new getter function, when called twice with the same rule, would be good unit coverage.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is especially bad for us running in AWS because inside Auth we call get_credentials which is an HTTP call to the Ec2 metdata service:

refreshable_credential=session.get_credentials(),

es_client = self.es_clients.get(key)
if es_client is None:
es_client = elasticsearch_client(rule)
self.es_clients[key] = es_client
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could be condensed into a single line,

self.es_clients[key] = es_client = elasticsearch_client(rule)

Not sure what your stylistic preference is.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer readability over condensed code, so what you have looks fine.

@JeffAshton JeffAshton requested a review from jertel June 28, 2021 16:28
Copy link
Owner

@jertel jertel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@jertel jertel merged commit e1231c2 into jertel:master Jun 28, 2021
@JeffAshton
Copy link
Contributor Author

JeffAshton commented Jun 28, 2021

Looking good with this fix:

image

Running 210 rules every 2.5 minutes ^

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Feb 22, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants