Example #1
0
func (c *Condition) checkContains(event common.MapStr) bool {
outer:
	for field, equalValue := range c.contains {
		value, err := event.GetValue(field)
		if err != nil {
			return false
		}

		switch value.(type) {
		case string:
			if !strings.Contains(value.(string), equalValue) {
				return false
			}
		case *string:
			if !strings.Contains(*value.(*string), equalValue) {
				return false
			}
		case []string:
			for _, s := range value.([]string) {
				if strings.Contains(s, equalValue) {
					continue outer
				}
			}
			return false
		default:
			logp.Warn("unexpected type %T in contains condition as it accepts only strings.", value)
			return false
		}
	}

	return true
}
Example #2
0
func (c *Condition) CheckEquals(event common.MapStr) bool {

	for field, equalValue := range c.Equals {

		value, err := event.GetValue(field)
		if err != nil {
			logp.Debug("filter", "unavailable field %s: %v", field, err)
			return false
		}

		switch value.(type) {
		case uint8, uint16, uint32, uint64, int8, int16, int32, int64, int, uint:
			return value == equalValue.Int
		case string:
			return value == equalValue.Str
		default:
			logp.Warn("unexpected type %T in equals condition as it accepts only integers and strings. ", value)
			return false
		}

	}

	return true

}
Example #3
0
func (c *Condition) CheckRegexp(event common.MapStr) bool {

	for field, equalValue := range c.Regexp {

		value, err := event.GetValue(field)
		if err != nil {
			logp.Debug("filter", "unavailable field %s: %v", field, err)
			return false
		}

		switch value.(type) {
		case string:
			if !equalValue.MatchString(value.(string)) {
				return false
			}
		default:
			logp.Warn("unexpected type %T in regexp condition as it accepts only strings. ", value)
			return false
		}

	}

	return true

}
Example #4
0
func (c *Condition) checkEquals(event common.MapStr) bool {

	for field, equalValue := range c.equals {

		value, err := event.GetValue(field)
		if err != nil {
			return false
		}

		intValue, err := extractInt(value)
		if err == nil {
			if intValue != equalValue.Int {
				return false
			}
		} else {
			sValue, err := extractString(value)
			if err != nil {
				logp.Warn("unexpected type %T in equals condition as it accepts only integers and strings. ", value)
				return false
			}
			if sValue != equalValue.Str {
				return false
			}
		}
	}

	return true

}
Example #5
0
func (f decodeJSONFields) Run(event common.MapStr) (common.MapStr, error) {
	var errs []string

	for _, field := range f.fields {
		data, err := event.GetValue(field)
		if err != nil && errors.Cause(err) != common.ErrKeyNotFound {
			debug("Error trying to GetValue for field : %s in event : %v", field, event)
			errs = append(errs, err.Error())
			continue
		}
		text, ok := data.(string)
		if ok {
			var output interface{}
			err := unmarshal(f.maxDepth, []byte(text), &output, f.processArray)
			if err != nil {
				debug("Error trying to unmarshal %s", event[field])
				errs = append(errs, err.Error())
				continue
			}

			_, err = event.Put(field, output)
			if err != nil {
				debug("Error trying to Put value %v for field : %s", output, field)
				errs = append(errs, err.Error())
				continue
			}
		}
	}

	if len(errs) > 0 {
		return event, fmt.Errorf(strings.Join(errs, ", "))
	}
	return event, nil
}
Example #6
0
// TODO: move to libbeat/common?
func fieldString(event common.MapStr, field string) (string, error) {
	type stringer interface {
		String() string
	}

	v, err := event.GetValue(field)
	if err != nil {
		return "", err
	}

	switch s := v.(type) {
	case string:
		return s, nil
	case []byte:
		return string(s), nil
	case stringer:
		return s.String(), nil
	case int8, int16, int32, int64, int:
		i := reflect.ValueOf(s).Int()
		return strconv.FormatInt(i, 10), nil
	case uint8, uint16, uint32, uint64, uint:
		u := reflect.ValueOf(s).Uint()
		return strconv.FormatUint(u, 10), nil
	case float32:
		return strconv.FormatFloat(float64(s), 'g', -1, 32), nil
	case float64:
		return strconv.FormatFloat(s, 'g', -1, 64), nil
	default:
		logp.Warn("Can not convert key '%v' value to string", v)
		return "", errConvertString
	}
}
Example #7
0
// TODO: move to libbeat/common?
func fieldString(event common.MapStr, field string) (string, error) {
	v, err := event.GetValue(field)
	if err != nil {
		return "", err
	}

	s, err := tryConvString(v)
	if err != nil {
		logp.Warn("Can not convert key '%v' value to string", v)
	}
	return s, err
}
Example #8
0
func hashFieldValue(h hash.Hash32, event common.MapStr, field string) error {
	type stringer interface {
		String() string
	}

	type hashable interface {
		Hash32(h hash.Hash32) error
	}

	v, err := event.GetValue(field)
	if err != nil {
		return err
	}

	switch s := v.(type) {
	case hashable:
		err = s.Hash32(h)
	case string:
		_, err = h.Write([]byte(s))
	case []byte:
		_, err = h.Write(s)
	case stringer:
		_, err = h.Write([]byte(s.String()))
	case int8, int16, int32, int64, int,
		uint8, uint16, uint32, uint64, uint:
		err = binary.Write(h, binary.LittleEndian, v)
	case float32:
		tmp := strconv.FormatFloat(float64(s), 'g', -1, 32)
		_, err = h.Write([]byte(tmp))
	case float64:
		tmp := strconv.FormatFloat(s, 'g', -1, 32)
		_, err = h.Write([]byte(tmp))
	default:
		// try to hash using reflection:
		err = binary.Write(h, binary.LittleEndian, v)
		if err != nil {
			err = fmt.Errorf("can not hash key '%v' of unknown type", field)
		}
	}
	return err
}
Example #9
0
func (c *Condition) checkRegexp(event common.MapStr) bool {

	for field, equalValue := range c.regexp {

		value, err := event.GetValue(field)
		if err != nil {
			return false
		}

		sValue, err := extractString(value)
		if err != nil {
			logp.Warn("unexpected type %T in regexp condition as it accepts only strings. ", value)
			return false
		}
		if !equalValue.MatchString(sValue) {
			return false
		}
	}

	return true

}
Example #10
0
func (c *Condition) CheckRange(event common.MapStr) bool {

	for field, rangeValue := range c.Range {

		value, err := event.GetValue(field)
		if err != nil {
			logp.Debug("filter", "unavailable field %s: %v", field, err)
			return false
		}

		switch value.(type) {
		case int, int8, int16, int32, int64:
			int_value := reflect.ValueOf(value).Int()

			if rangeValue.Gte != nil {
				if int_value < int64(*rangeValue.Gte) {
					return false
				}
			}
			if rangeValue.Gt != nil {
				if int_value <= int64(*rangeValue.Gt) {
					return false
				}
			}
			if rangeValue.Lte != nil {
				if int_value > int64(*rangeValue.Lte) {
					return false
				}
			}
			if rangeValue.Lt != nil {
				if int_value >= int64(*rangeValue.Lt) {
					return false
				}
			}

		case uint, uint8, uint16, uint32, uint64:
			uint_value := reflect.ValueOf(value).Uint()

			if rangeValue.Gte != nil {
				if uint_value < uint64(*rangeValue.Gte) {
					return false
				}
			}
			if rangeValue.Gt != nil {
				if uint_value <= uint64(*rangeValue.Gt) {
					return false
				}
			}
			if rangeValue.Lte != nil {
				if uint_value > uint64(*rangeValue.Lte) {
					return false
				}
			}
			if rangeValue.Lt != nil {
				if uint_value >= uint64(*rangeValue.Lt) {
					return false
				}
			}

		case float64, float32:
			float_value := reflect.ValueOf(value).Float()

			if rangeValue.Gte != nil {
				if float_value < *rangeValue.Gte {
					return false
				}
			}
			if rangeValue.Gt != nil {
				if float_value <= *rangeValue.Gt {
					return false
				}
			}
			if rangeValue.Lte != nil {
				if float_value > *rangeValue.Lte {
					return false
				}
			}
			if rangeValue.Lt != nil {
				if float_value >= *rangeValue.Lt {
					return false
				}
			}

		default:
			logp.Warn("unexpected type %T in range condition as it accepts only strings. ", value)
			return false
		}

	}
	return true
}
Example #11
0
func (c *Condition) checkRange(event common.MapStr) bool {

	checkValue := func(value float64, rangeValue RangeValue) bool {

		if rangeValue.gte != nil {
			if value < *rangeValue.gte {
				return false
			}
		}
		if rangeValue.gt != nil {
			if value <= *rangeValue.gt {
				return false
			}
		}
		if rangeValue.lte != nil {
			if value > *rangeValue.lte {
				return false
			}
		}
		if rangeValue.lt != nil {
			if value >= *rangeValue.lt {
				return false
			}
		}
		return true
	}

	for field, rangeValue := range c.rangexp {

		value, err := event.GetValue(field)
		if err != nil {
			return false
		}

		switch value.(type) {
		case int, int8, int16, int32, int64:
			intValue := reflect.ValueOf(value).Int()

			if !checkValue(float64(intValue), rangeValue) {
				return false
			}

		case uint, uint8, uint16, uint32, uint64:
			uintValue := reflect.ValueOf(value).Uint()

			if !checkValue(float64(uintValue), rangeValue) {
				return false
			}

		case float64, float32:
			floatValue := reflect.ValueOf(value).Float()

			if !checkValue(floatValue, rangeValue) {
				return false
			}

		default:
			logp.Warn("unexpected type %T in range condition as it accepts only strings. ", value)
			return false
		}

	}
	return true
}