Use None instead of empty data structures when no ElasticSearch logs #34793
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Depends on #34790
Previously, when there were no logs, we would just use [] or {} and continue to process them through functions such as "group by host" and such. But if no logs are found, it's odd to go down those paths.
One example of the confusion is the return type in
es_readwaslist | ElasticSearchResponse. This makes it look like it would either be a list (presumably of logs?) or an ElasticSearchResponse object (presumably also containing logs?). But in reality, the only time list was returned, was when there were no logs at all! This was just to adhere to the contract that we handle "no logs" the same as "logs". (And it turns out that ElasticSearchResponse magically also behaves like at iterable which is also confusing but that's a separate issue.)