Make notification rules queryable

core/db/elastic.py

@@ -14,6 +14,7 @@ from core.lib.parsing import (
     QueryError,
     parse_date_time,
     parse_index,
+    parse_rule,
     parse_sentiment,
     parse_size,
     parse_sort,
@@ -32,6 +33,7 @@ mapping = {
             "ts": {"type": "date", "format": "epoch_second"},
             "match_ts": {"type": "date", "format": "iso8601"},
             "file_tim": {"type": "date", "format": "epoch_millis"},
+            "rule_uuid": {"type": "keyword"},
         }
     }
 }
@@ -271,7 +273,6 @@ class ElasticsearchBackend(StorageBackend):
         if self.async_client is None:
             await self.async_initialise()
         for match in matches:
-            print("INDEXING", match)
             result = await self.async_client.index(
                 index=settings.INDEX_RULE_STORAGE, body=match
             )
@@ -439,10 +440,18 @@ class ElasticsearchBackend(StorageBackend):
             if isinstance(size, dict):
                 return size
 
-        # I - Index
-        index = parse_index(request.user, query_params)
-        if isinstance(index, dict):
-            return index
+        rule_object = parse_rule(request.user, query_params)
+        if isinstance(rule_object, dict):
+            return rule_object
+
+        if rule_object is not None:
+            index = settings.INDEX_RULE_STORAGE
+            add_bool.append({"rule_uuid": str(rule_object.id)})
+        else:
+            # I - Index
+            index = parse_index(request.user, query_params)
+            if isinstance(index, dict):
+                return index
 
         # Q/T - Query/Tags
         search_query = self.parse_query(