예제 #1
0
파일: indexer.go 프로젝트: jasonish/evebox
func (i *Indexer) AddEvent(event eve.RawEveEvent) error {
	uuid := uuid.NewV1()
	timestamp, err := event.GetTimestamp()
	if err != nil {
		log.Error("Failed to get timestamp from event: %v", err)
	}
	encoded, err := json.Marshal(&event)
	if err != nil {
		log.Error("Failed to encode event.")
	}

	_, err = i.stmt.Exec(uuid, timestamp, string(encoded))
	if err != nil {
		log.Fatal(err)
	}

	return nil
}
예제 #2
0
func (i *BulkEveIndexer) IndexRawEvent(event eve.RawEveEvent) error {

	timestamp, err := event.GetTimestamp()
	if err != nil {
		return err
	}
	event["@timestamp"] = timestamp.UTC().Format(AtTimestampFormat)
	index := fmt.Sprintf("%s-%s", i.IndexPrefix, timestamp.UTC().Format("2006.01.02"))

	header := BulkCreateHeader{}
	header.Create.Index = index
	header.Create.Type = "log"
	header.Create.Id = uuid.NewV1().String()

	encoder := json.NewEncoder(i.pipeWriter)

	encoder.Encode(&header)
	encoder.Encode(event)

	i.queued++

	return nil
}