enrich

Documentation

Index

• type AlertEnricher
  • func (e *AlertEnricher) Enrich(events []alert.AlertEvent) error
  • func (e *AlertEnricher) RemoveRuleByDeletedSchema(schema string)
• type Enricher
• type JQParser
• type TagEnricher
  • func NewTagEnricher(enrichRule alert.AlertEnrichRuleVO, dbRepo database.Repo, Order int) (*TagEnricher, error)
  • func (e *TagEnricher) Enrich(alertEvent *alert.AlertEvent)
  • func (e *TagEnricher) RuleID() string
  • func (e *TagEnricher) RuleOrder() int

Types

type AlertEnricher

type AlertEnricher struct {
	*alert.SourceFrom
	Enrichers []Enricher

	// RuleID -> Enricher
	EnricherMap sync.Map
	// contains filtered or unexported fields
}

func (*AlertEnricher) Enrich

func (e *AlertEnricher) Enrich(events []alert.AlertEvent) error

func (*AlertEnricher) RemoveRuleByDeletedSchema

func (e *AlertEnricher) RemoveRuleByDeletedSchema(schema string)

type Enricher

type Enricher interface {
	RuleID() string
	RuleOrder() int
	Enrich(*alert.AlertEvent)
}

type JQParser

type JQParser struct {
	FromJQExpression string // JQ expression composed of condition and fromField
	JQParser         *gojq.Query
}

type TagEnricher

type TagEnricher struct {
	ID    string
	Order int

	RType string

	*JQParser

	DBRepo database.Repo

	// ---------------- tagMapping ----------------
	TargetTagId int
	CustomTag   string

	// ---------------- schemaMapping ----------------
	Schema       string
	SchemaSource string
	SchemaTarget []alert.AlertEnrichSchemaTarget

	TargetTags []alert.TargetTag
	// contains filtered or unexported fields
}

func NewTagEnricher

func NewTagEnricher(
	enrichRule alert.AlertEnrichRuleVO,
	dbRepo database.Repo,
	Order int,
) (*TagEnricher, error)

func (*TagEnricher) Enrich

func (e *TagEnricher) Enrich(alertEvent *alert.AlertEvent)

func (*TagEnricher) RuleID

func (e *TagEnricher) RuleID() string

func (*TagEnricher) RuleOrder

func (e *TagEnricher) RuleOrder() int