
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
contexture-elasticsearch
Advanced tools
Elasticsearch Provider for Contexture
This provider takes a config object as a parameter, and expects a getClient
method to be provided, which should be an instantiated elasticsearch client.
This provider takes a config object as a parameter:
Option | Type | Description | Required |
---|---|---|---|
getClient | function | Returns an instantiated elasticsearch client | x |
request | object | Merged in the json body of every request to elasticsearch (e.g. to add custom headers) | |
types | object | Contexture node types, like all other providers |
Schemas with with an elasticsearch provider can specify any or all of the following properties:
Option | Type | Description | Required |
---|---|---|---|
index | string | Which ES index to use when querying | x |
type | string | Which ES type to use when querying | |
summaryView | function | Used by results to return a summary view instead of the whole document, (e.g. for indexes with many fields). Defaults to returning the hit property. | |
highlight | object | Used by results to determine what fields to highlight, and whether or not they are inline (copied over inline on to the source) or additional (in a list of additional fields that matched) |
module.exports = {
elasticsearch: {
index: 'SomeIndex',
type: 'SomeType'
}
}
let _ = require('lodash')
let Contexture = require('contexture')
let provider = require('contexture-elasticsearch')
let types = require('contexture-elasticsearch/types')
let schemas = require('./path/to/schemas')
let elasticsearch = require('elasticsearch')
let AgentKeepAlive = require('agentkeepalive'),
let process = Contexture({
schemas,
providers: {
elasticsearch: provider({
getClient: _.memoize(() =>
elasticsearch.Client({
// This is an example config, see the elasticsearch js docs for more
minSockets: 1,
maxSockets: 20,
keepAlive: true,
createNodeAgent: (connection, config) =>
new AgentKeepAlive(connection.makeAgentConfig(config))
})
),
request: {
headers: {
'custom-header-app-name': 'my-app-sent-this'
}
},
types: types({
geo: {
geocodeLocation: query =>
googleplaces.textSearch({
query
})
}
})
})
}
})
These types both filter and have contextual results.
facet
Facet represents a list of dynamic choices, e.g. a checkbox list filter.
Input
Name | Type | Default | Description |
---|---|---|---|
field | string | None, required | The field it's operating on |
mode | include /exclude | include | Should this filter act as inclusion or exclusion of the values |
values | array[string] | [] | What is checked |
fieldMode | autocomplete /word /suggest | autocomplete | Whether to look at the entire field (autocomplete), the analyzed words in the field, or magic suggestions. This generally means switching field/analyzers but abstracts that lower level es/index knowledge away from the client. |
size | number | 12 | How many options to return |
cardinality | number | 5000 | Precision threshold override |
includeZeroes | boolean | false | If true, it will include options with 0 matching documents (aka min_doc_count: 0 ) |
optionsFilter | string | '' | Filters the options further, e.g. a find box above a checkbox list |
caseSensitive | boolean | false | Whether options filter is case sensitive. no known usages |
sort | term /count | count | Sort results alphabetically or by count of matching records |
Output
{
cardinality: Number, // Cardinality (total number of options) for the field
options: [{
name: String,
count: Number
}]
}
geo
Represents a geographic radius search. Needs a geocodeLocation service passed in to it. Currently assumes it is a google maps geocoder search.
Input
Name | Type | Default | Description |
---|---|---|---|
field | string | None, required | The field it's operating on |
location | string | None, required | Location to geocode (e.g. an address, businessname, anything the google geocode can take) |
radius | number | None, required | Radius in miles |
operator | within /not within | within | Whether the filter forces inclusion or exclusion |
Output
{
place: GeocodeLocationResponse
}
The result can be used to show what location the server on a map, though in practice it's usually better to geocode on the client. This type is planned to be extended to support passing along raw lat/lng.
Filter only types just filter and nothing more. They don't have contextual results of their own.
bool
Bool represent a boolean check, e.g. a checkbox for true/false
{
field: String,
value: String|Boolean
}
date
Date represents a data range filter, with support datemath
{
field: String,
from: DateString|'thisQuarter|lastQuarter|nextQuarter', // Date string or one of three custom date math options
to: DateString,
useDateMath: Boolean // If true, it will parse dates as dateMath using @elastic/datemath
}
exists
Exists represents whether or not a field is present on results
{
field: String,
value: Boolean // Whether the field should exist or not
}
number
Number represents a number range with inclusive bounds. This type is planned to be extended to return contextual info on min, max, and histogram value distribution.
Some Notes:
{
field: String,
min: Number,
max: Number
}
query
Query represents a raw elasticsearch query_string.
{
field: String,
query: String, // The actual query
exact: Boolean // Represents opting out of stemming. Currently assumes the presence of an `.exact` subfield and analyzer. Defaults to false.
}
text
These types don't do any filtering of their own and only have results. These often power charts or analytics pages.
cardinality
dateHistogram
esTwoLevelAggregation
groupedMetric
matchCardinality
matchStats
nLevelAggregation
nonzeroClusters
percentileRanks
percentiles
percentilesRange
rangeStats
results
smartIntervalHistogram
smartPercentileRanks
statistical
terms
termsDelta
termsStatsHits
terms_stats
twoLevelMatch
FAQs
ElasticSearch Provider for Contexture
The npm package contexture-elasticsearch receives a total of 244 weekly downloads. As such, contexture-elasticsearch popularity was classified as not popular.
We found that contexture-elasticsearch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.