func (c *Condition) checkContains(event common.MapStr) bool {
outer:
for field, equalValue := range c.contains {
value, err := event.GetValue(field)
if err != nil {
return false
}
switch value.(type) {
case string:
if !strings.Contains(value.(string), equalValue) {
return false
}
case *string:
if !strings.Contains(*value.(*string), equalValue) {
return false
}
case []string:
for _, s := range value.([]string) {
if strings.Contains(s, equalValue) {
continue outer
}
}
return false
default:
logp.Warn("unexpected type %T in contains condition as it accepts only strings.", value)
return false
}
}
return true
}
func (c *Condition) CheckEquals(event common.MapStr) bool {
for field, equalValue := range c.Equals {
value, err := event.GetValue(field)
if err != nil {
logp.Debug("filter", "unavailable field %s: %v", field, err)
return false
}
switch value.(type) {
case uint8, uint16, uint32, uint64, int8, int16, int32, int64, int, uint:
return value == equalValue.Int
case string:
return value == equalValue.Str
default:
logp.Warn("unexpected type %T in equals condition as it accepts only integers and strings. ", value)
return false
}
}
return true
}
func (c *Condition) CheckRegexp(event common.MapStr) bool {
for field, equalValue := range c.Regexp {
value, err := event.GetValue(field)
if err != nil {
logp.Debug("filter", "unavailable field %s: %v", field, err)
return false
}
switch value.(type) {
case string:
if !equalValue.MatchString(value.(string)) {
return false
}
default:
logp.Warn("unexpected type %T in regexp condition as it accepts only strings. ", value)
return false
}
}
return true
}
func (c *Condition) checkEquals(event common.MapStr) bool {
for field, equalValue := range c.equals {
value, err := event.GetValue(field)
if err != nil {
return false
}
intValue, err := extractInt(value)
if err == nil {
if intValue != equalValue.Int {
return false
}
} else {
sValue, err := extractString(value)
if err != nil {
logp.Warn("unexpected type %T in equals condition as it accepts only integers and strings. ", value)
return false
}
if sValue != equalValue.Str {
return false
}
}
}
return true
}
func (f decodeJSONFields) Run(event common.MapStr) (common.MapStr, error) {
var errs []string
for _, field := range f.fields {
data, err := event.GetValue(field)
if err != nil && errors.Cause(err) != common.ErrKeyNotFound {
debug("Error trying to GetValue for field : %s in event : %v", field, event)
errs = append(errs, err.Error())
continue
}
text, ok := data.(string)
if ok {
var output interface{}
err := unmarshal(f.maxDepth, []byte(text), &output, f.processArray)
if err != nil {
debug("Error trying to unmarshal %s", event[field])
errs = append(errs, err.Error())
continue
}
_, err = event.Put(field, output)
if err != nil {
debug("Error trying to Put value %v for field : %s", output, field)
errs = append(errs, err.Error())
continue
}
}
}
if len(errs) > 0 {
return event, fmt.Errorf(strings.Join(errs, ", "))
}
return event, nil
}
// TODO: move to libbeat/common?
func fieldString(event common.MapStr, field string) (string, error) {
type stringer interface {
String() string
}
v, err := event.GetValue(field)
if err != nil {
return "", err
}
switch s := v.(type) {
case string:
return s, nil
case []byte:
return string(s), nil
case stringer:
return s.String(), nil
case int8, int16, int32, int64, int:
i := reflect.ValueOf(s).Int()
return strconv.FormatInt(i, 10), nil
case uint8, uint16, uint32, uint64, uint:
u := reflect.ValueOf(s).Uint()
return strconv.FormatUint(u, 10), nil
case float32:
return strconv.FormatFloat(float64(s), 'g', -1, 32), nil
case float64:
return strconv.FormatFloat(s, 'g', -1, 64), nil
default:
logp.Warn("Can not convert key '%v' value to string", v)
return "", errConvertString
}
}
// TODO: move to libbeat/common?
func fieldString(event common.MapStr, field string) (string, error) {
v, err := event.GetValue(field)
if err != nil {
return "", err
}
s, err := tryConvString(v)
if err != nil {
logp.Warn("Can not convert key '%v' value to string", v)
}
return s, err
}
func hashFieldValue(h hash.Hash32, event common.MapStr, field string) error {
type stringer interface {
String() string
}
type hashable interface {
Hash32(h hash.Hash32) error
}
v, err := event.GetValue(field)
if err != nil {
return err
}
switch s := v.(type) {
case hashable:
err = s.Hash32(h)
case string:
_, err = h.Write([]byte(s))
case []byte:
_, err = h.Write(s)
case stringer:
_, err = h.Write([]byte(s.String()))
case int8, int16, int32, int64, int,
uint8, uint16, uint32, uint64, uint:
err = binary.Write(h, binary.LittleEndian, v)
case float32:
tmp := strconv.FormatFloat(float64(s), 'g', -1, 32)
_, err = h.Write([]byte(tmp))
case float64:
tmp := strconv.FormatFloat(s, 'g', -1, 32)
_, err = h.Write([]byte(tmp))
default:
// try to hash using reflection:
err = binary.Write(h, binary.LittleEndian, v)
if err != nil {
err = fmt.Errorf("can not hash key '%v' of unknown type", field)
}
}
return err
}
func (c *Condition) checkRegexp(event common.MapStr) bool {
for field, equalValue := range c.regexp {
value, err := event.GetValue(field)
if err != nil {
return false
}
sValue, err := extractString(value)
if err != nil {
logp.Warn("unexpected type %T in regexp condition as it accepts only strings. ", value)
return false
}
if !equalValue.MatchString(sValue) {
return false
}
}
return true
}
func (c *Condition) CheckRange(event common.MapStr) bool {
for field, rangeValue := range c.Range {
value, err := event.GetValue(field)
if err != nil {
logp.Debug("filter", "unavailable field %s: %v", field, err)
return false
}
switch value.(type) {
case int, int8, int16, int32, int64:
int_value := reflect.ValueOf(value).Int()
if rangeValue.Gte != nil {
if int_value < int64(*rangeValue.Gte) {
return false
}
}
if rangeValue.Gt != nil {
if int_value <= int64(*rangeValue.Gt) {
return false
}
}
if rangeValue.Lte != nil {
if int_value > int64(*rangeValue.Lte) {
return false
}
}
if rangeValue.Lt != nil {
if int_value >= int64(*rangeValue.Lt) {
return false
}
}
case uint, uint8, uint16, uint32, uint64:
uint_value := reflect.ValueOf(value).Uint()
if rangeValue.Gte != nil {
if uint_value < uint64(*rangeValue.Gte) {
return false
}
}
if rangeValue.Gt != nil {
if uint_value <= uint64(*rangeValue.Gt) {
return false
}
}
if rangeValue.Lte != nil {
if uint_value > uint64(*rangeValue.Lte) {
return false
}
}
if rangeValue.Lt != nil {
if uint_value >= uint64(*rangeValue.Lt) {
return false
}
}
case float64, float32:
float_value := reflect.ValueOf(value).Float()
if rangeValue.Gte != nil {
if float_value < *rangeValue.Gte {
return false
}
}
if rangeValue.Gt != nil {
if float_value <= *rangeValue.Gt {
return false
}
}
if rangeValue.Lte != nil {
if float_value > *rangeValue.Lte {
return false
}
}
if rangeValue.Lt != nil {
if float_value >= *rangeValue.Lt {
return false
}
}
default:
logp.Warn("unexpected type %T in range condition as it accepts only strings. ", value)
return false
}
}
return true
}
func (c *Condition) checkRange(event common.MapStr) bool {
checkValue := func(value float64, rangeValue RangeValue) bool {
if rangeValue.gte != nil {
if value < *rangeValue.gte {
return false
}
}
if rangeValue.gt != nil {
if value <= *rangeValue.gt {
return false
}
}
if rangeValue.lte != nil {
if value > *rangeValue.lte {
return false
}
}
if rangeValue.lt != nil {
if value >= *rangeValue.lt {
return false
}
}
return true
}
for field, rangeValue := range c.rangexp {
value, err := event.GetValue(field)
if err != nil {
return false
}
switch value.(type) {
case int, int8, int16, int32, int64:
intValue := reflect.ValueOf(value).Int()
if !checkValue(float64(intValue), rangeValue) {
return false
}
case uint, uint8, uint16, uint32, uint64:
uintValue := reflect.ValueOf(value).Uint()
if !checkValue(float64(uintValue), rangeValue) {
return false
}
case float64, float32:
floatValue := reflect.ValueOf(value).Float()
if !checkValue(floatValue, rangeValue) {
return false
}
default:
logp.Warn("unexpected type %T in range condition as it accepts only strings. ", value)
return false
}
}
return true
}