#logtype = "ansible"
| processId = ?processId
| selectLast([play])

#logtype = "ansible"
| processId = ?processId

#logtype = "ansible"
| processId = ?processId
| @rawstring = "*PLAY RECAP*"
| count()
| _count match {
    0 => Status := "Running...";
    * => Status := "Finished"
}
| select(["Status"])

#logtype = "ansible"
| processId = ?processId
| selectLast([task])

#logtype = "ansible"
| processId = ?processId
| reason = "UNREACHABLE"
| count(field=host, distinct=true)

#logtype = "ansible"
| groupBy(processId, function=[{
            @rawstring = "*PLAY RECAP*" | count() | _count match { 0 => "Is running?" := "Yes"; * => "Is running?" := "No"} | drop(_count)
          },
          {
            play = * | collect([play], limit=3) | rename(field="play", as="First 3 plays")
          },
          {
            play = * | count(as="No. of plays")
          },
          {
           [
             { failureIgnored = "true" | count(as="ignoredFailures") },
             { state = "fatal" | count(as="failures") }
           ]
           | unignoredFailures := failures - ignoredFailures
           | unignoredFailures match { 0 => "Any failure?" := "No"; * => "Any failure?" := "Yes"} | drop(unignoredFailures)
          },
          {
            state = "changed" | count() | _count match { 0 => "Any changes?" := "No"; * => "Any changes?" := "Yes"} | drop(_count)
          },
            selectLast([@timestamp])
          ])
| rename(field="processId", as="Process ID")
| sort(@timestamp)
| formatTime(format="%a %T", as="Last seen")
| table(["Process ID", "Last seen", "Is running?", "Any failure?", "Any changes?", "No. of plays", "First 3 plays"])

#logtype = "ansible"
| processId = ?processId
| count(field=host, distinct=true)

#logtype = "ansible"
| processId = ?processId
| [ { failureIgnored = "true" | count(as="ignoredFailures") },
    { state = "fatal" | count(as="failures") }
]
| unignoredFailures := failures - ignoredFailures
| select([unignoredFailures])

#logtype = "ansible"
| processId = ?processId
| case {
    state = "fatal"| failureID := @id;
    *
}
| [
    // Collect event IDs and task names for task failures, so we can use the ID later to retrieve the "host" and "details" fields.
    // "host" and "details" cannot be collected here directly, due to the memory limits imposed on "series".
    series([failureID, task], startmatch={ task = * }, endmatch={ @rawstring = "* PLAY *" }),

    // For any task failure, look at the next event to determine if the failure was ignored.
    { series([failureID, failureIgnored], startmatch={ state = "fatal" }, endmatch={ @rawstring = "* PLAY *" or task = * }) | drop([@timestamp, _duration]) | rename(field="failureID", as="ignoredFailureID") }
  ]
| failureID != ""
| splitString(by="\n", field="failureID", as="failureID")
| split(field="failureID")
| case {
    test(failureID != ignoredFailureID) | failureIgnored := "false";
    *
  }
| groupBy(failureID, function=[
    selectLast(task),
    { failureIgnored = "true" | count() | _count match { 0 => failureIgnored := "false"; * => failureIgnored := "true"} }
])
| join({
    #logtype = "ansible"
    | processId = ?processId
    | state = "fatal"
}, field="failureID", key="@id", include=[host, details])
| rename(field="task", as="Task")
| rename(field="host", as="Host")
| rename(field="details", as="Details")
| rename(field="failureIgnored", as="Ignored?")
| "Ignored?" match {
    "true" => "Ignored?" := "Yes";
    "false" => "Ignored?" := "No"
}
| table([Task, Host, "Ignored?", Details])

#logtype = "ansible"
| state = *
| processId = ?processId
| groupBy([host, state])

#logtype = "ansible"
| processId = ?processId
| reason = "UNREACHABLE"
| groupBy([host], function=[])
| rename(field="host", as="Host")

#logtype = "ansible"
| processId = ?processId
| failureIgnored = "true"
| count()

#logtype = "ansible"
| processId = ?processId
| groupBy([host], function=[])
| rename(field="host", as="Host")