types

type AXDefinition struct {
	Name        string    `toml:"name,omitempty" json:",omitempty"`
	Desc        string    `toml:"desc,omitempty" json:",omitempty"`
	Module      string    `toml:"module"`
	Params      string    `toml:"params" json:",omitempty"`
	Args        string    `toml:"args,omitempty" json:",omitempty"`
	Tag         string    `toml:"tag"`
	Tags        []string  `toml:"tags"` // AXs can support multiple tags. For backwards compatibility, we leave Tag and add Tags
	Labels      []string  `toml:"-"`
	UID         int32     `toml:"-"`
	GIDs        []int32   `toml:"-"`
	Global      bool      `toml:"-"`
	UUID        uuid.UUID `toml:"-"`
	Synced      bool      `toml:"-" json:"-"`
	LastUpdated time.Time `toml:"-"`
}

type Access struct {
	Global bool
	GIDs   []int32
}

type Actions struct {
	Delete bool
	Modify bool
	Share  bool
}

type AddGroup struct {
	Name string
	Desc string
}

type AddUser struct {
	User  string
	Pass  string
	Name  string
	Email string
	Admin bool
}

type AdminActionResp struct {
	UID   int32 `json:",omitempty"`
	Admin bool  `json:",omitempty"`
}

type AlertConsumer struct {
	ID string `json:"ID"`

	Type AlertConsumerType `json:"Type"`
}

type AlertConsumerType string

type AlertConsumerValidateRequest struct {
	Consumer AlertConsumer

	Alert AlertDefinition
}

type AlertConsumerValidateResponse struct {
	Valid bool

	Error string
}

type AlertDefinition struct {
	// The actions the user is allowed to take on this definition.
	// Derived by the backend when requested by the user; any
	// value sent in a request will be ignored.
	Can Actions `json:"Can"`

	// A list of flows which will be run when alerts are generated.
	Consumers []AlertConsumer `json:"Consumers"`

	Description string `json:"Description"`

	Disabled bool `json:"Disabled"`

	// A list of things which create alerts (currently only scheduled searches).
	Dispatchers []AlertDispatcher `json:"Dispatchers"`

	GIDs []int32 `json:"GIDs"`

	GUID uuid.UUID `json:"GUID"`

	Global bool `json:"Global"`

	Labels []string `json:"Labels"`

	LastUpdated time.Time `json:"LastUpdated"`

	// Maximum number of events allowed per firing of the alert. This is
	// intended as a safety valve to avoid thousands of emails. If zero,
	// a (low) default value will be used.
	MaxEvents int `json:"MaxEvents"`

	Name string `json:"Name"`

	// How long, in seconds, we should save searches which trigger this alert.
	SaveSearchDuration int32 `json:"SaveSearchDuration"`

	// Whether or not searches which trigger the alert should be saved
	SaveSearchEnabled bool `json:"SaveSearchEnabled"`

	// A JSON schema describing the expected fields in the alerts.
	Schemas AlertSchemas `json:"Schemas"`

	// The tag into which alerts will be ingested
	TargetTag string `json:"TargetTag"`

	ThingUUID uuid.UUID `json:"ThingUUID"`

	// The owner of the Alert
	UID int32 `json:"UID"`

	// Arbitrary user-defined metadata which will be injected into the events
	UserMetadata map[string]interface{} `json:"UserMetadata"`

	// Sharing rules for this alert.
	WriteAccess Access `json:"WriteAccess"`
}

type AlertDispatcher struct {
	ID string `json:"ID"`

	Type AlertDispatcherType `json:"Type"`
}

type AlertDispatcherType string

type AlertDispatcherValidateError struct {

	// The path that led to the error
	Path string

	InvalidValue *interface{}

	// Human-friendly information as to why the item failed
	Message string
}

type AlertDispatcherValidateRequest struct {
	Dispatcher AlertDispatcher

	QueryString string

	Schema AlertSchemas
}

type AlertDispatcherValidateResponse struct {

	// If true, the dispatcher generates all required fields in the schema.
	Valid bool

	// Names of fields which were missing.
	ValidationErrors []AlertDispatcherValidateError
}

type AlertSchemas struct {

	// The "simple" schema, if any is defined.
	Simple []AlertSchemasSimpleItem

	// A schema derived from an OCSF spec.
	OCSF AlertSchemasOcsf

	// A user-provided JSON schema.
	JSON map[string]interface{}

	ActiveSchema string
}

type AlertSchemasOcsf struct {
	EventClass string

	Extensions []string

	Profiles []string
}

type AlertSchemasSimpleItem struct {
	Name string

	Type string
}

type ApiInfo struct {
	Major uint32
	Minor uint32
}

type AttachSearchRequest struct {
	ID string
}

type AttachSearchResponse struct {
	Error       string      `json:",omitempty"` //error if not
	Subproto    string      `json:",omitempty"` //the new subprotocol
	RendererMod string      `json:",omitempty"` //the renderer in use
	RendererCmd string      `json:",omitempty"` //the renderer commands
	Info        *SearchInfo `json:",omitempty"` //info if available
}

type AuthorInfo struct {
	Name    string
	Email   string
	Company string
	URL     string
}

type BackendNotification struct {
	Notification
	Action NotificationAction
	GUID   uuid.UUID
}

type BackupConfig struct {
	IncludeSS     bool   // Include scheduled searches
	OmitSensitive bool   // Omit sensitive items
	Password      string // password to use when encrypting backup file
}

type BackupResponse struct {
	DownloadID string
	Expiration time.Time
}

type BaseRequest struct {
	ID         uint32
	Stats      *SearchStatsRequest `json:",omitempty"`
	EntryRange *EntryRange         `json:",omitempty"`
	Addendum   json.RawMessage     `json:",omitempty"`
}

type BaseResponse struct {
	ID         uint32                    // DEPRECATED - REST API no longer returns this value
	Stats      *SearchStatsResponse      `json:",omitempty"`
	Addendum   json.RawMessage           `json:",omitempty"`
	SearchInfo *SearchInfo               `json:",omitempty"`
	EntryRange *EntryRange               `json:",omitempty"`
	Metadata   *SearchMetadata           `json:",omitempty"`
	Tags       map[string]entry.EntryTag `json:",omitempty"`
	Error      string                    `json:",omitempty"`

	// Finished is true when the query has completed.
	Finished bool

	// EntryCount is the number of entries which *entered* the renderer.
	EntryCount uint64
	// For some renderers, the EntryCount accurately represents the total
	// number of results available. This field is set to 'true' in that case,
	// meaning the EntryCount number can be displayed alongside the results
	// without confusion.
	EntryCountValid bool

	// If set, there are more entries for the given timeframe available.
	// For non-condensing this means EntryCount > request.Last
	// For condensing, this means that given the range, there are values
	// available after the Last range.
	AdditionalEntries bool

	// Indicates that the query results exceeded the on-disk storage limits.
	OverLimit bool
	// Indicates the range of entries that were dropped due to storage limits.
	LimitDroppedRange TimeRange

	//SessionID is the search Session ID, used for tracking "handles" on a search using REST interface
	SessionID uuid.UUID

	//Interval is the number of seconds between hits on the search control REST API for a given second
	//that can transpire before we consider the search session abandoned
	Interval uint
}

type BuildInfo struct {
	CanonicalVersion
	BuildDate  time.Time `json:",omitempty"`
	BuildID    string    `json:",omitempty"`
	GUIBuildID string    `json:",omitempty"`
}

type CBACRules struct {
	Capabilities CapabilitySet
	Tags         TagAccess
}

type CalendarEntry struct {
	Date         string `json:"date"`
	DataIngested uint64 `json:"dataIngested"`
	EntryCount   uint64 `json:"entryCount"`
}

type CalendarRequest struct {
	Start time.Time `json:"start"`
	End   time.Time `json:"end"`
	Wells []string  `json:"wells"`
}

type CanonicalVersion struct {
	Major uint32
	Minor uint32
	Point uint32
}

type CapError struct {
	Cap   string
	Error string
}

type Capability uint16

type CapabilityCategory string

type CapabilityDesc struct {
	Cap      Capability
	Name     string
	Desc     string
	Category CapabilityCategory
}

type CapabilityExplanation struct {
	CapabilityDesc
	Granted     bool           // True if the user has this capability
	UserGrant   bool           // True if the capability was explicitly granted to the user
	GroupGrants []GroupDetails // An array of groups to which the user belongs that grant the capability.
}

type CapabilitySet struct {
	Grants []byte
}

type CapabilityState struct {
	Grants []string
}

type CapabilityTemplate struct {
	Name string
	Desc string
	Caps []Capability
}

type ChangePassword struct {
	OrigPass string
	NewPass  string
}

type ChartRequest struct {
	BaseRequest
}

type ChartResponse struct {
	BaseResponse
	Entries ChartableValueSet
}

type Chartable struct {
	Data []ChartableDataPoint
	TS   entry.Timestamp
}

type ChartableDataPoint float64

type ChartableSet []Chartable

type ChartableValueSet struct {
	Names      []string
	KeyComps   []KeyComponents `json:",omitempty"`
	Categories []string        `json:",omitempty"`
	Values     ChartableSet
}

type Dashboard struct {
	ID          uint64
	Name        string
	UID         int32
	GIDs        []int32
	Global      bool
	Description string
	Created     time.Time
	Updated     time.Time
	Data        RawObject
	Labels      []string
	GUID        string `json:",omitempty"`
	Trivial     bool   `json:",omitempty"`
	Synced      bool
}

type DashboardAdd struct {
	Name        string
	Description string
	Data        RawObject
	Labels      []string
	UID         int32
	GIDs        []int32
	Global      bool
}

type DashboardComment struct {
	ID      int
	UID     int
	Name    string
	Comment string
}

type DashboardGet struct {
	Name     string
	Desc     string
	JSON     []byte
	User     string
	Score    int `json:",omitempty"`
	Version  int `json:",omitempty"`
	GUID     string
	Created  time.Time
	Updated  time.Time
	Customer string
	Tags     []string
}

type DashboardPost struct {
	Name string
	Desc string
	JSON []byte
	User string
	Tags []string
}

type Dashboards []Dashboard

type DeploymentInfo struct {
	Distributed     bool //distributed webservers, meaning more than one
	CBACEnabled     bool //whether CBAC is enabled on the system
	DefaultLanguage string
}

type DiskIO struct {
	Device string
	Read   uint64
	Write  uint64
}

type DiskStats struct {
	Mount     string
	Partition string
	Total     uint64
	Used      uint64
	// unique ID for this disk on this host
	// essentially a hash of indexer UUID, Mount, and Partition
	// this is used to uniquely identify a disk and mount on a specific host
	// uses are for when multiple indexers have the same disk topology
	// or docker clusters where everything is identical
	ID string
}

type Edge struct {
	Value int64 `json:"value"`
	// Source and Destination nodes for an edge are represented by an index
	// into the parent node set
	Src int `json:"source"` // index into the source node list
	Dst int `json:"target"` // index into the destination node list
}

type Element struct {
	Module      string
	Args        string `json:",omitempty"`
	Name        string
	Path        string
	Value       interface{}
	SubElements []Element `json:",omitempty"`
	Filters     []string
}

type EntryRange struct {
	StartTS entry.Timestamp `json:",omitempty"`
	EndTS   entry.Timestamp `json:",omitempty"`
	First   uint64
	Last    uint64
}

type EnumeratedPair struct {
	Name     string
	Value    string             `json:"ValueStr"`
	RawValue RawEnumeratedValue `json:"Value"`
}

type ErrorObject struct {
	Err  string `json:"error"`
	Info string `json:"info,omitempty"`
}

type Event struct {
	Type     EventType
	Metadata EventMetadata          `json:",omitempty"`
	Contents map[string]interface{} `json:",omitempty"`
}

type EventConsumerInfo struct {
	Type   AlertConsumerType
	ID     string
	Name   string
	Labels []string `json:",omitempty"`
}

type EventDispatcherInfo struct {
	Type         AlertDispatcherType
	ID           string
	Name         string   `json:",omitempty"`
	SearchID     string   `json:",omitempty"`
	Labels       []string // any labels attached to this dispatcher
	EventCount   int      // number of events that were generated by the dispatcher
	EventsElided bool     // true if we had to drop events because there were too many results
}

type EventLog struct {
	Type    EventType
	Level   string
	Message string            `json:",omitempty"`
	KV      map[string]string `json:",omitempty"`
	Trigger Event             `json:",omitempty"`
}

type EventMetadata struct {
	UID                int32
	Username           string
	Created            time.Time
	AlertID            string // ThingUUID of the Alert
	AlertName          string
	AlertActivation    string // uniquely identify the particular activation of the alert
	EventIndex         int    // this event's index within the dispatcher results for the alert activation
	TargetTag          string // the tag this got sent to
	AlertLabels        []string
	Dispatcher         EventDispatcherInfo
	Consumers          []EventConsumerInfo    `json:",omitempty"` // consmers which will be launched for this event
	UserMetadata       map[string]interface{} // this is arbitrary stuff that the user attached to the alert def.
	ValidationProblems []ValidationProblem    `json:",omitempty"`
}

type EventType string

type ExploreRequest struct {
	Start int64
	End   int64
}

type ExploreResult struct {
	Elements []Element `json:",omitempty"`
	// This represents the module which generated the result, but
	// individual Elements may have a different module set for
	// purposes of filtering.
	Module      string
	Tag         string
	WordOffsets []WordOffset `json:",omitempty"`
}

type FdgRequest struct {
	BaseRequest
}

type FdgResponse struct {
	BaseResponse
	Entries FdgSet
}

type FdgSet struct {
	Nodes  []Node   `json:"nodes"`
	Edges  []Edge   `json:"links"`
	Groups []string `json:"groups"`
}

type FeatureOverride uint64

type Features struct {
	Replication     bool
	SingleSignon    bool
	Overwatch       bool
	NoStats         bool
	UnlimitedCPU    bool
	CBAC            bool
	UnlimitedIngest bool
}

type FilterRequest struct {
	Tag    string
	Module string
	Args   string `json:",omitempty"`
	Path   string // The path to extract
	Name   string // The desired output name
	Op     string
	Value  string
}

type FlowNodeResult struct {
	Payload map[string]interface{}
	ID      int    // the node ID
	Type    string // the type of node, e.g. RunQuery
	Log     string
	Error   string
	Start   int64 // unix nanoseconds
	End     int64 // unix nanoseconds
	// The first node executed has sequence 0, the next is sequence 1, etc.
	// Nodes which were not executed have Sequence = SEQ_NODE_NOT_EXECUTED
	Sequence int
}

type FlowParseRequest struct {
	Flow       string
	DebugEvent *Event // If provided, this will be set as `event` in the flow payload for parsing.
}

type FlowParseResponse struct {
	OK bool

	// Error and ErrorNode are now deprecated; look at the Failures map
	// to see if there were parse problems. They are retained for compatibility.
	Error     string `json:",omitempty"`
	ErrorNode int    // the node which failed to parse (ignore if Error is empty)

	OutputPayloads map[int]map[string]interface{}
	InitialPayload map[string]interface{} // the payload which gets passed to nodes with no dependencies
	Failures       map[int]NodeParseFailure
}

type GUISettings struct {
	DistributedWebservers bool
	DisableMapTileProxy   bool
	MapTileUrl            string

	// If true, the UI shouldn't display any notifications about new features
	DisableFeaturePopups bool

	// Indicates that we're in cloud mode - changes some behaviors
	CloudMode bool

	ServerTime           time.Time
	ServerTimezone       string
	ServerTimezoneOffset int

	MaxFileSize        uint64 // the maximum size allowed for user file uploads
	MaxResourceSize    uint64 // the largest resource you're allowed to make
	MaxJsonRequestSize uint64 // the largest object you're allowed to send in a JSON request body

	IngestAllowed bool // set to true if the user is allowed to use the ingest APIs
	NonCommercial bool // set to true if the license is a non-commercial license
}

type GaugeRequest struct {
	BaseRequest
}

type GaugeResponse struct {
	BaseResponse
	Entries []GaugeValue
}

type GaugeValue struct {
	Name      string
	Magnitude float64
	Min       float64
	Max       float64
}

type GenerateAXRequest struct {
	Tag     string
	Entries []SearchEntry
}

type GenerateAXResponse struct {
	Extractor AXDefinition
	// Confidence is a range from 0 to 10, with 10 meaning "we are very confident"
	// and 0 meaning "we didn't extract anything of worth".
	// Some modules, like xml, will return values lower than 10 even if they extracted
	// lots of data, because other modules like winlog should take precedence if they
	// succeed.
	Confidence float64
	Entries    []SearchEntry
	Explore    []ExploreResult
}

type Geofence struct {
	SouthWest Location `json:",omitempty"`
	NorthEast Location `json:",omitempty"`
	// contains filtered or unexported fields
}

type GroupDetails struct {
	GID    int32
	Name   string
	Desc   string
	Synced bool
	CBAC   CBACRules `json:"-"` //do not include in API responses
}

type HeatmapRequest struct {
	BaseRequest
	Fence Geofence `json:",omitempty"`
}

type HeatmapResponse struct {
	BaseResponse
	Entries []HeatmapValue `json:",omitempty"`
}

type HeatmapValue struct {
	Location
	Magnitude float64 `json:",omitempty"`
}

type HostSysStats struct {
	Uptime                uint64  `json:",omitempty"`
	TotalMemory           uint64  `json:",omitempty"`
	ProcessHeapAllocation uint64  `json:",omitempty"` // bytes allocated by this process's heap
	ProcessSysReserved    uint64  `json:",omitempty"` // total bytes obtained from the OS
	MemoryUsedPercent     float64 `json:",omitempty"`
	Disks                 []DiskStats
	CPUUsage              float64
	CPUCount              int `json:",omitempty"`
	HostHash              string
	Net                   NetworkUsage `json:",omitempty"`
	IO                    []DiskIO
	VirtSystem            string       `json:",omitempty"` // e.g. "kvm" or "xen"
	VirtRole              string       `json:",omitempty"` // "host" or "guest"
	BuildInfo             BuildInfo    `json:",omitempty"` // e.g. 3.3.1
	LoadAverage           load.AvgStat `json:",omitempty"`
	Iowait                float64
}

type IdKitState struct {
	UUID        uuid.UUID
	UID         int32
	GIDs        []int32
	Global      bool
	WriteAccess Access
	KitState
}

type IdxStatResponse struct {
	Error string              `json:",omitempty"`
	Stats map[string]IdxStats `json:",omitempty"`
}

type IdxStats struct {
	UUID       uuid.UUID
	Error      string              `json:",omitempty"`
	IndexStats []IndexManagerStats `json:",omitempty"`
}

type ImportInfo struct {
	Imported  bool
	Time      time.Time //timestamp of when the results were imported
	BatchName string    //potential import batch name
	BatchInfo string    //potential import batch notes

}

type IndexManagerStats struct {
	Name  string
	Stats []IndexerStats
}

type IndexerPingResponse struct {
	Error  string            `json:",omitempty"`
	States map[string]string `json:",omitempty"`
}

type IndexerRequest struct {
	DialString string

	Forwarded bool // If set, do NOT propagate this message to other webservers
}

type IndexerStats struct {
	ID          string // unique well ID based on the indexer UUID and the well ID assigned at indexer startup
	Data        uint64
	Entries     uint64
	Path        string
	Cold        bool
	Accelerator string `json:",omitempty"`
	Extractor   string `json:",omitempty"`
}

type IndexerWellData struct {
	UUID  uuid.UUID
	Wells []WellInfo
	//Key is the UUID of the remote system that we have replicated data for
	//the value is the list of wells and their data
	Replicated map[uuid.UUID][]WellInfo
}

type IngestResponse struct {
	Count int64
	Size  int64
	Tags  []string
}

type IngestStats struct {
	QuotaUsed         uint64     // Quota used so far
	QuotaMax          uint64     // Total quota
	EntriesPerSecond  float64    // Entries per second over the last few seconds
	BytesPerSecond    float64    // Bytes per second over the last few seconds
	TotalCount        uint64     //Total Entries since the ingest server started
	TotalSize         uint64     //Total Data since the ingest server started
	LastDayCount      uint64     //total entries in last 24 hours
	LastDaySize       uint64     //total ingested in last 24 hours
	EntriesHourTail   [24]uint64 //entries per 1 hour bucket with 24 hours of tail
	EntriesMinuteTail [60]uint64 //entries per 1 second bucket with 60s of tail
	BytesHourTail     [24]uint64 //bytes per 1 hour bucket with 24 hours of tail
	BytesMinuteTail   [60]uint64 //bytes per 1 second bucket with 60s of tail
	Ingesters         []IngesterStats
	Missing           []ingest.IngesterState //ingesters that have been seen before but not actively connected now
}

type IngesterStats struct {
	RemoteAddress string
	Count         uint64
	Size          uint64
	Uptime        time.Duration
	Tags          []string
	Name          string
	Version       string
	UUID          string
	State         ingest.IngesterState
}

type IngesterStatsResponse struct {
	Error string                 `json:",omitempty"`
	Stats map[string]IngestStats `json:",omitempty"`
}

type InstallStatus struct {
	Owner int32
	Done  bool

	Percentage  float64
	CurrentStep string
	Error       string
	Log         string
	InstallID   int32
	Updated     time.Time
	// contains filtered or unexported fields
}

type KeyComponents struct {
	Keys []string
}

type KitBuildRequest struct {
	ID                string
	Name              string
	Description       string
	Readme            string
	Version           uint
	MinVersion        CanonicalVersion  `json:",omitempty"`
	MaxVersion        CanonicalVersion  `json:",omitempty"`
	Dashboards        []uint64          `json:",omitempty"`
	Templates         []uuid.UUID       `json:",omitempty"`
	Pivots            []uuid.UUID       `json:",omitempty"`
	Resources         []string          `json:",omitempty"`
	ScheduledSearches []int32           `json:",omitempty"`
	Flows             []int32           `json:",omitempty"`
	Macros            []uint64          `json:",omitempty"`
	Extractors        []uuid.UUID       `json:",omitempty"`
	Files             []uuid.UUID       `json:",omitempty"`
	SearchLibraries   []uuid.UUID       `json:",omitempty"`
	Playbooks         []uuid.UUID       `json:",omitempty"`
	Alerts            []uuid.UUID       `json:",omitempty"`
	EmbeddedItems     []KitEmbeddedItem `json:",omitempty"`
	Icon              string            `json:",omitempty"`
	Banner            string            `json:",omitempty"`
	Cover             string            `json:",omitempty"`
	Dependencies      []KitDependency   `json:",omitempty"`
	ConfigMacros      []KitConfigMacro
	ScriptDeployRules map[int32]ScriptDeployConfig
}

type KitBuildResponse struct {
	UUID string
	Size int64
	UID  int32 `json:",omitempty"`
}

type KitConfig struct {
	OverwriteExisting       bool  `json:",omitempty"`
	Global                  bool  `json:",omitempty"`
	AllowExternalResource   bool  `json:",omitempty"`
	AllowUnsigned           bool  `json:",omitempty"`
	InstallationGroup       int32 `json:",omitempty"` // deprecated, use InstallationGroups instead
	InstallationGroups      []int32
	InstallationWriteAccess Access
	Labels                  []string `json:",omitempty"` // labels applied to each *item*
	KitLabels               []string `json:",omitempty"` // labels applied to the *kit* itself
	ConfigMacros            []KitConfigMacro
	ScriptDeployRules       map[string]ScriptDeployConfig // overrides for defaults
}

type KitConfigMacro struct {
	MacroName     string // The name of the macro which will be created
	Description   string // a verbose description of what this *does*
	DefaultValue  string // Should be defined at kit creation time
	Value         string // Set by the UI when preparing for installation
	Type          string // "TAG" or "OTHER"
	InstalledByID string // if the macro already exists, the ID of the kit that installed it
}

type KitDependency struct {
	ID         string
	MinVersion uint
}

type KitEmbeddedItem struct {
	KitItem
	Content []byte `json:",omitempty"` //the actual contents of the kit
}

type KitItem struct {
	Name           string
	Type           string
	ID             string          `json:",omitempty"` //the UUID
	AdditionalInfo json.RawMessage `json:",omitempty"`
	Hash           [sha256.Size]byte
}

type KitItemStatus struct {
	Item  KitItem
	Error string
}

type KitManifest struct {
	UID         int32
	GIDs        []int32
	Global      bool
	WriteAccess Access
	UUID        uuid.UUID
	Data        []byte
	WebserverID uuid.UUID // which webserver created this manifest: needed to manage staged manifests & on-disk kit files
	Synced      bool
}

type KitMetadata struct {
	ID            string
	Name          string
	GUID          string `json:",omitempty"` // DEPRECATED, TODO: remove
	UUID          string
	Version       uint
	Description   string
	Readme        string
	Signed        bool
	AdminRequired bool
	MinVersion    CanonicalVersion
	MaxVersion    CanonicalVersion
	Size          int64
	Created       time.Time
	Ingesters     []string //ingesters associated with the kit
	Tags          []string //tags associated with the kit
	Assets        []KitMetadataAsset
	Dependencies  []KitDependency
	Items         []KitItem
	ConfigMacros  []KitConfigMacro
}

type KitMetadataAsset struct {
	Type     string
	Source   string //URL
	Legend   string //some description about the asset
	Featured bool   //should be an image, will be used for cover image
	Banner   bool   //should be an image, will be used for upper banner image
}

type KitModifyReport struct {
	Statuses []KitItemStatus
	WasError bool
}

type KitState struct {
	ID                   string
	Name                 string
	Description          string
	Readme               string
	UUID                 string
	Signed               bool
	AdminRequired        bool
	MinVersion           CanonicalVersion `json:",omitempty"`
	MaxVersion           CanonicalVersion `json:",omitempty"`
	UID                  int32            `json:",omitempty"`
	Version              uint
	Items                []KitItem
	Labels               []string
	Icon                 string           //use for icon when in the context of a kit
	Banner               string           //use for banner in a kit
	Cover                string           //use for cover image on a kit
	ModifiedItems        []SourcedKitItem // Items which were installed by a previous version of the kit and have been modified by the user
	ConflictingItems     []KitItem        // items which will overwrite a user-created object
	RequiredDependencies []KitMetadata
	Installed            bool             //true means everything was pushed in, false means it is JUST staged
	InstallationTime     time.Time        // the time at which this kit was installed
	InstallationVersion  CanonicalVersion // the Gravwell version in use when this kit was installed
	ConfigMacros         []KitConfigMacro
	Metadata             json.RawMessage `json:",omitempty"`
}

type LaunchRequest struct {
	StartSearchRequest
}

type LaunchResponse struct {
	SearchSessionID uuid.UUID `json:",omitempty"`
	// RefreshInterval is used to convey and optionally update the minimum interval
	// required in between touching a search session.  This value defines how often a client
	// must refresh thier search session before a search may be expired due to inactivity
	RefreshInterval uint //refresh interval in seconds

	// unified info that is always needed
	SearchID     string     `json:",omitempty"`
	RenderModule string     `json:",omitempty"`
	RenderCmd    string     `json:",omitempty"`
	Info         SearchInfo `json:",omitempty"`
}

type LicenseDistributionStatus struct {
	Status string                 `json:"status"`
	States []LicenseIndexerStatus `json:"states,omitempty"`
}

type LicenseIndexerInfo struct {
	Indexer string      `json:"indexer"`
	Error   error       `json:"error,omitempty"`
	Info    LicenseInfo `json:"info,omitempty"`
}

type LicenseIndexerStatus struct {
	Indexer  string `json:"indexer"`
	Serviced bool   `json:"ready"`
	Error    string `json:"error,omitempty"`
}

type LicenseInfo struct {
	Version        uint64
	CustomerUUID   string `json:",omitempty"`
	CustomerNumber uint64
	Expiration     entry.Timestamp
	Type           LicenseType
	//MaxNodes is either maximum machines for cluster type, or sockets for single type
	MaxNodes  uint32
	Overrides FeatureOverride
	Metadata  []byte
	NFR       bool //non-commercial license override
	Hash      []byte
}

type LicenseType uint64

type LicenseUpdateError struct {
	Name string
	Err  string
}

type LicenseUsage struct {
	Unlimited bool                 // license is unlimited, nothing else will be here
	Quota     uint64               // license ingest limitation
	Used      uint64               // license ingest usage
	Entries   uint64               // total count of entries (does not impact license)
	History   []LicenseUsageBucket `json:",omitempty"`
	Error     error                `json:",omitempty"`
}

type LicenseUsageBucket struct {
	Start time.Time //start of this bucket
	End   time.Time //end of this bucket
	Size  uint64    //ingest bucket size
	Count uint64    //ingest bucket count
}

type LicenseUsageReport struct {
	Unlimited bool                    //every single reporting indexer has unlimited ingest OR an error, nothing to report
	Indexers  map[string]LicenseUsage `json:",omitempty"` // if all indexers are unlimited this won't bbe included at all
}

type Location struct {
	Lat  float64
	Long float64
}

type LogLevel struct {
	Level string
}

type LoggingLevels struct {
	Levels  []string
	Current string
}

type LoginRequest struct {
	User string
	Pass string
}

type LoginResponse struct {
	LoginStatus bool
	Reason      string `json:",omitempty"`
	Admin       bool   `json:",omitempty"`
	JWT         string `json:",omitempty"`
}

type ModuleHint struct {
	Name            string
	ProducedEVs     []string
	ConsumedEVs     []string
	ResourcesNeeded []string
	Condensing      bool
}

type ModuleStatsUpdate struct {
	InputCount, OutputCount uint64
	InputBytes, OutputBytes uint64
	Duration                time.Duration
}

type NetworkUsage struct {
	Up   uint64
	Down uint64
}

type Node struct {
	Name  string `json:"name"`
	Group int    `json:"group"`
}

type NodeParseError struct {
	Err   string
	Field string `json:",omitempty"`
}

type NodeParseFailure struct {
	Errors []NodeParseError
}

type Notification struct {
	UID         int32
	GID         int32
	Sender      int32     //who sent it
	Type        uint32    //ID which specifies the type of notification
	Broadcast   bool      //was this a broadcast to multiple users
	Sent        time.Time //when was it sent
	Expires     time.Time //when does it expire
	IgnoreUntil time.Time //Don't display until after this time
	Msg         string
	Origin      uuid.UUID // which device sent it (currently only used on indexers)
	Level       string    `json:",omitempty"` //generic keyword indicating how bad this notification is
	Link        string    `json:",omitempty"`
}

type NotificationAction uint32

type NotificationSet map[uint64]Notification

type OverviewStatSet struct {
	Count uint64
	Bytes uint64
	TS    entry.Timestamp
}

type OverviewStats struct {
	//indicates where in the search span the query currently is, can be used for progress
	SearchPosition entry.Timestamp
	//indicates if the search is finished
	Finished bool
	// Indicates that the query results exceeded the on-disk storage limits.
	OverLimit bool
	// Indicates the range of entries that were dropped due to storage limits.
	LimitDroppedRange TimeRange
	// For some renderers, the EntryCount accurately represents the total
	// number of results available. This field is set to 'true' in that case,
	// meaning the EntryCount number can be displayed alongside the results
	// without confusion.
	EntryCountValid bool
	EntryCount      uint64
	Stats           []OverviewStatSet `json:",omitempty"`
}

type P2PRequest struct {
	BaseRequest
	Fence Geofence `json:",omitempty"`
}

type P2PResponse struct {
	BaseResponse
	ValueNames []string
	Entries    []P2PValue `json:",omitempty"`
}

type P2PValue struct {
	Src       Location
	Dst       Location
	Magnitude float64  `json:",omitempty"`
	Values    []string `json:",omitempty"`
}

type PackedPivot struct {
	UUID        string
	Name        string
	Description string
	Data        RawObject
	Labels      []string
}

type PackedUserTemplate struct {
	UUID        string
	Name        string
	Description string
	Data        TemplateContents
	Labels      []string
}

type ParseSearchRequest struct {
	SearchString string
	Sequence     uint64
	Filters      []FilterRequest
}

type ParseSearchResponse struct {
	Sequence    uint64
	GoodQuery   bool
	ParseError  string `json:",omitempty"`
	ParsedQuery string `json:",omitempty"`
	RawQuery    string `json:",omitempty"`
	ModuleIndex int
	SearchHints
}

type PerWellStorageStats struct {
	StorageStats
	Accelerator    string   `json:"accelerator"`
	Engine         string   `json:"engine"`
	PathCold       string   `json:"pathCold"`
	PathHot        string   `json:"pathHot"`
	ShardCountCold uint64   `json:"shardCountCold"`
	ShardCountHot  uint64   `json:"shardCountHot"`
	Tags           []string `json:"tags"`
	WellName       string   `json:"wellName"`
}

type PingReq struct {
	X error `json:",omitempty"`
}

type Pivot struct {
	GUID        uuid.UUID
	Name        string
	Description string
	Contents    RawObject
	Labels      []string
	Disabled    bool
}

type Playbook struct {
	UUID        uuid.UUID
	GUID        uuid.UUID // global identifier, used to uniquely identify a playbook rather than as a key in the webstore. Sorry.
	UID         int32
	GIDs        []int32
	Global      bool
	WriteAccess Access
	Name        string
	Desc        string
	Body        []byte `json:",omitempty"`
	Metadata    []byte `json:",omitempty"`
	Labels      []string
	LastUpdated time.Time
	Author      AuthorInfo
	Synced      bool
}

type PointmapKV struct {
	Key   string
	Value string
}

type PointmapRequest struct {
	BaseRequest
	Fence Geofence `json:",omitempty"`
}

type PointmapResponse struct {
	BaseResponse
	Entries []PointmapValue `json:",omitempty"`
}

type PointmapValue struct {
	Loc      Location
	Metadata []PointmapKV `json:",omitempty"`
}

type RawEnumeratedValue struct {
	Type uint16
	Data []byte
}

type RawObject json.RawMessage

type RawRequest struct {
	BaseRequest
}

type RawResponse struct {
	BaseResponse
	ContainsBinaryEntries bool            //just a flag to tell the GUI that we might have data that needs some help
	Entries               []SearchEntry   `json:",omitempty"`
	Explore               []ExploreResult `json:",omitempty"`
}

type RenderModuleInfo struct {
	Name        string
	Description string
	Examples    []string
}

type ReplicationState struct {
	UUID    uuid.UUID
	Entries uint64
	Size    uint64
}

type ResourceContentType struct {
	ContentType string
	Body        []byte
}

type ResourceList struct {
	List   []ResourceMetadata
	Domain int16
}

type ResourceMetadata struct {
	UID           int32     // owner
	GUID          string    // unique ID for this resource
	Domain        int16     // The webserver domain of this resource. Only webservers in this domain can access it.
	LastModified  time.Time // time resource was modified, including metadata
	VersionNumber int       // resource version #, increment at each Write
	GroupACL      []int32   // GIDs which can access the resource
	Global        bool      // if Global is set, any user can read the resource.
	ResourceName  string
	Description   string
	Size          uint64
	Hash          []byte
	Synced        bool     // Set to true if this version is on the datastore, false otherwise
	Labels        []string // the backend doesn't really care about these, it's the GUI's problem
}

type ResourceUpdate struct {
	Metadata ResourceMetadata
	Data     []byte
	// contains filtered or unexported fields
}

type RespError struct {
	Error string `json:",omitempty"`
}

type SSOStatus struct {
	Enabled bool `json:"enabled"`
}

type SaveSearchPatch struct {
	SearchLaunchInfo
	// these are the supported fields in the free form search metadata; these are used by the GUI
	Name  string `json:"name,omitempty"`
	Notes string `json:"notes,omitempty"`
}

type ScheduledError struct {
	Error     string
	Timestamp time.Time
}

type ScheduledSearch struct {
	Synced      bool
	ID          int32
	GUID        uuid.UUID
	Groups      []int32
	Global      bool
	WriteAccess Access
	Name        string // the name of this scheduled search
	Description string // freeform description
	Labels      []string
	Owner       int32  // uid of owner
	Schedule    string // when to run: a cron spec
	Timezone    string // a location to use for the timezone, e.g. "America/New_York"
	Updated     time.Time
	Disabled    bool

	// These values are used for debug/testing runs
	OneShot    bool   // Set this flag to 'true' to make the search fire ONCE
	DebugMode  bool   // set this to true to enable debug mode
	DebugEvent *Event // If provided, this will be inserted as `event` into the flow payload.

	// if true, search agent will attempt to "backfill" missed runs since
	// the more recent of Updated or LastRun.
	BackfillEnabled bool

	// This sets what kind of scheduled "thing" it is: search, script, or flow
	ScheduledType string

	// Fields for scheduled searches
	SearchReference    uuid.UUID // A reference to a saved query item by UUID. If SearchString is populated on a GET, it represents the query referenced by SearchReference.
	SearchString       string    // The actual search to run. If SearchReference is populated on a GET, SearchString represents the query referenced by SearchReference.
	Duration           int64     // How many seconds back to search, MUST BE NEGATIVE
	SearchSinceLastRun bool      // If set, ignore Duration and run from last run time to now.
	TimeframeOffset    int64     // How many seconds to offset the search timeframe, MUST BE NEGATIVE.

	// For scheduled scripts
	Script         string     // If set, execute the contents rather than running SearchString
	ScriptLanguage ScriptLang // what script type is this: anko, go

	// For scheduled flows
	Flow            string                 // The flow specification itself
	FlowNodeResults map[int]FlowNodeResult // results for each node in the flow

	// These fields are updated by the search agent after it runs a search
	PersistentMaps  map[string]map[string]interface{}
	LastRun         time.Time
	LastRunDuration time.Duration    // how many nanoseconds did it take
	LastSearchIDs   []string         // the IDs of the most recently performed searches
	LastError       string           // any error from the last run of the scheduled search
	ErrorHistory    []ScheduledError // a list of previously-occurring errors
	DebugOutput     []byte           // output of the script if debugmode was enabled
}

type ScheduledSearchParseRequest struct {
	Version int
	Script  string
}

type ScheduledSearchParseResponse struct {
	OK          bool
	Error       string `json:",omitempty"`
	ErrorLine   int
	ErrorColumn int
}

type ScriptDeployConfig struct {
	Disabled       bool
	RunImmediately bool
}

type ScriptLang uint

type SearchAgentCheckin struct {
	LastCheckin     string
	Warning         bool
	SearchAgentUUID string
	SearchAgentIP   string
}

type SearchAgentConfig struct {
	Searchagent_UUID                 string
	Webserver_Address                []string
	Insecure_Skip_TLS_Verify         bool
	Insecure_Use_HTTP                bool
	Search_Agent_Auth                string
	Scratch_Path                     string
	Max_Script_Run_Time              int64 // minutes!
	Log_File                         string
	Log_Level                        string
	Disable_Network_Script_Functions bool // disables "risky" scripting functions (network stuff)
	Disable_Self_Ingest              bool // disables ingesting search agent logs to indexers
	HTTP_Proxy                       string
}

type SearchCtrlStatus struct {
	ID              string
	UID             int32
	GID             int32
	State           string
	AttachedClients int
	StoredData      int64
	UserQuery       string
	EffectiveQuery  string
	StartRange      time.Time
	EndRange        time.Time
	NoHistory       bool
	Import          ImportInfo
	LaunchInfo      SearchLaunchInfo
}

type SearchEntry struct {
	TS         entry.Timestamp
	SRC        net.IP
	Tag        entry.EntryTag
	Data       []byte
	Enumerated []EnumeratedPair
}

type SearchHints struct {
	CollapsingIndex  int      // index of the first collapsed module
	RenderModule     string   `json:",omitempty"`
	TimeZoomDisabled bool     //Renderer does not support zooming around data based on time
	Tags             []string //the tags involved in the search
	ModuleHints      []ModuleHint
}

type SearchInfo struct {
	ID                    string          //ID of the search
	UID                   int32           //UID of the user that actually kicked off the search
	GID                   int32           `json:",omitempty"` //Group ID the search was assigned to
	UserQuery             string          //query provided by the user on search
	EffectiveQuery        string          //the effective query that was actually used
	StartRange            time.Time       //start time range
	EndRange              time.Time       //end time range
	Descending            bool            //the direction the search is progressing (Descending is the standard)
	Started               time.Time       //time when the search was kicked off
	LastUpdate            time.Time       //last timestamp we saw (tells us where indexers are working)
	Duration              time.Duration   //Amount of time required to complete the search
	StoreSize             int64           //size of the main storage file
	IndexSize             int64           //size of an extra index file
	ItemCount             int64           //How many items have been stored
	TimeZoomDisabled      bool            //Renderer does not support zooming around data based on time
	RenderDownloadFormats []string        `json:",omitempty"`
	Metadata              json.RawMessage `json:",omitempty"` //additional metadata associated with a search
	Name                  string          `json:",omitempty"`
	CollapsingIndex       int
	NoHistory             bool // set to true if this search was launched with the "no history" flag, typically means it is an automated search.
	Background            bool // set to true if this search has been marked as backgrounded.
	MinZoomWindow         uint // what is the smallest minimum zoom window in seconds
	Tags                  []string
	Import                ImportInfo `json:",omitempty"` //information attached if there this search is saved and from an external import
	// Preview indicates that this search is a preview search
	// this means that the query most likely did not cover the entire time range that was originally requested
	// A preview search is used when a user is trying to understand what they have or establish AX relationships
	Preview bool

	LaunchInfo SearchLaunchInfo // information about how a search was launched
}

type SearchLaunchInfo struct {
	//what launched the search, manual, directquery, scheduledsearch, etc...
	Method string `json:"method,omitempty"`

	// Reference is the UUID, ID, etc. of the thing that launched the search
	// this is blank for manual queries
	Reference string `json:"reference,omitempty"`

	// Started is the timestamp of when the search was started.  This is used to inform
	// the GUI and/or clients on when the query was actually started.
	Started time.Time `json:"started,omitempty"`

	// Expires marks when when the search should expire/be deleted,
	// it may be the zero value which means never
	Expires time.Time `json:"expires,omitempty"`
}

type SearchLibrary struct {
	Name        string
	Description string
	Query       string `json:",omitempty"`
	GUID        uuid.UUID
	Labels      []string  `json:",omitempty"`
	Metadata    RawObject `json:",omitempty"`
}

type SearchLog struct {
	UID            int32  //who started the search
	GID            int32  //what group the search was assigned to, if any
	UserQuery      string //what the user actually typed
	EffectiveQuery string //what was actually run
	Launched       time.Time
	Synced         bool
}

type SearchMacro struct {
	ID          uint64
	UID         int32
	GIDs        []int32
	Global      bool
	WriteAccess Access
	Name        string
	Description string
	Expansion   string
	Labels      []string
	LastUpdated time.Time
	Synced      bool
}

type SearchMetadata struct {
	ValueStats  []SearchMetadataEntry `json:",omitempty"`
	SourceStats []SourceMetadataEntry `json:",omitempty"`
	TagStats    map[string]uint       `json:",omitempty"`
}

type SearchMetadataEntry struct {
	Name   string
	Type   string
	Number SearchMetadataNumber `json:",omitempty"`
	Raw    SearchMetadataRaw    `json:",omitempty"`
}

type SearchMetadataNumber struct {
	Count uint
	Min   float64
	Max   float64
}

type SearchMetadataRaw struct {
	Map   map[string]uint
	Other uint
}

type SearchModuleInfo struct {
	Name         string
	Info         string
	Examples     []string
	Collapsing   func(string) bool `json:"-"`
	FrontendOnly bool              // true if this module MUST run on frontend (anko)
	Sorting      bool
}

type SearchModuleStats struct {
	ModuleStatsUpdate
	Name, Args string
	// contains filtered or unexported fields
}

type SearchModuleStatsUpdate struct {
	Stats []SearchModuleStats
	TS    entry.Timestamp
}

type SearchSessionIntervalUpdate struct {
	Interval uint
}

type SearchStatsRequest struct {
	SetCount int64           `json:",omitempty"`
	SetStart entry.Timestamp `json:",omitempty"`
	SetEnd   entry.Timestamp `json:",omitempty"`
	Addendum json.RawMessage `json:",omitempty"`
}

type SearchStatsResponse struct {
	Addendum    json.RawMessage   `json:",omitempty"`
	RangeStart  entry.Timestamp   `json:",omitempty"`
	RangeEnd    entry.Timestamp   `json:",omitempty"`
	Current     entry.Timestamp   `json:",omitempty"`
	Set         []StatSet         `json:",omitempty"`
	OverviewSet []OverviewStatSet `json:",omitempty"`
	Size        int               `json:",omitempty"`
}

type Secret struct {
	ID      uuid.UUID `json:"id"`
	Name    string    `json:"name"`
	Desc    string    `json:"description"`
	UID     int32     `json:"uid"`
	Groups  []int32   `json:"groups,omitempty"`
	Global  bool      `json:"global"`
	Created time.Time `json:"created"`
}

type SecretCreate struct {
	Name   string  `json:"name"`
	Desc   string  `json:"description"`
	Groups []int32 `json:"groups,omitempty"`
	Global bool    `json:"global"`
	Value  string  `json:"value"`
}

type SecretFull struct {
	Secret
	Value string `json:"value"`
}

type Session struct {
	ID          uint64 `json:",omitempty"`
	JWT         string `json:",omitempty"`
	UID         int32  `json:",omitempty"`
	Origin      net.IP
	LastHit     time.Time
	UDets       *UserDetails `json:",omitempty"`
	TempSession bool
	Synced      bool
}