1 files changed, 70 insertions, 0 deletions
diff --git a/lib/gitlab/elasticsearch/logs/pods.rb b/lib/gitlab/elasticsearch/logs/pods.rb
new file mode 100644
index 00000000000..66499ae956a
--- /dev/null
+++ b/lib/gitlab/elasticsearch/logs/pods.rb
@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Elasticsearch
+    module Logs
+      class Pods
+        # How many items to fetch in a query
+        PODS_LIMIT = 500
+        CONTAINERS_LIMIT = 500
+
+        def initialize(client)
+          @client = client
+        end
+
+        def pods(namespace)
+          body = build_body(namespace)
+          response = @client.search body: body
+
+          format_response(response)
+        end
+
+        private
+
+        def build_body(namespace)
+          {
+            aggs: {
+              pods: {
+                aggs: {
+                  containers: {
+                    terms: {
+                      field: 'kubernetes.container.name',
+                      size: ::Gitlab::Elasticsearch::Logs::Pods::CONTAINERS_LIMIT
+                    }
+                  }
+                },
+                terms: {
+                  field: 'kubernetes.pod.name',
+                  size: ::Gitlab::Elasticsearch::Logs::Pods::PODS_LIMIT
+                }
+              }
+            },
+            query: {
+              bool: {
+                must: {
+                  match_phrase: {
+                    "kubernetes.namespace": namespace
+                  }
+                }
+              }
+            },
+            # don't populate hits, only the aggregation is needed
+            size: 0
+          }
+        end
+
+        def format_response(response)
+          results = response.dig("aggregations", "pods", "buckets") || []
+          results.map do |bucket|
+            {
+              name: bucket["key"],
+              container_names: (bucket.dig("containers", "buckets") || []).map do |cbucket|
+                cbucket["key"]
+              end
+            }
+          end
+        end
+      end
+    end
+  end
+end