def mock_hits(self, rule, start, end, index):
        docs = []
        for doc in self.data:
            if start <= ts_to_dt(doc[rule['timestamp_field']]) < end:
                docs.append(doc)

        # Remove all fields which don't match 'include'
        for doc in docs:
            fields_to_remove = []
            for field in doc:
                if field != '_id':
                    if not any([re.match(incl.replace('*', '.*'), field) for incl in rule['include']]):
                        fields_to_remove.append(field)
            map(doc.pop, fields_to_remove)

        # Separate _source and _id, convert timestamps
        resp = [{'_source': doc, '_id': doc['_id']} for doc in docs]
        for doc in resp:
            doc['_source'].pop('_id')
        ElastAlerter.process_hits(rule, resp)
        return resp
Aggresively search through your database's schema for a table.
dataset/ETHPy150Open Yelp/elastalert/elastalert/test_rule.py/MockElastAlerter.mock_hits--crossover with--dataset/ETHPy150Open yhat/db.py/db/db.py/DB.find_table