acquisition

Documentation

Index

• Variables
• func GetMetrics(sources []DataSource, aggregated bool) error
• func StartAcquisition(sources []DataSource, output chan types.Event, AcquisTomb *tomb.Tomb) error
• type DataSource
  • func DataSourceConfigure(commonConfig configuration.DataSourceCommonCfg) (*DataSource, error)
  • func GetDataSourceIface(dataSourceType string) DataSource
  • func LoadAcquisitionFromDSN(dsn string, labels map[string]string, transformExpr string) ([]DataSource, error)
  • func LoadAcquisitionFromFile(config *csconfig.CrowdsecServiceCfg) ([]DataSource, error)

Variables

var AcquisitionSources = map[string]func() DataSource{
	"file":        func() DataSource { return &fileacquisition.FileSource{} },
	"journalctl":  func() DataSource { return &journalctlacquisition.JournalCtlSource{} },
	"cloudwatch":  func() DataSource { return &cloudwatchacquisition.CloudwatchSource{} },
	"syslog":      func() DataSource { return &syslogacquisition.SyslogSource{} },
	"docker":      func() DataSource { return &dockeracquisition.DockerSource{} },
	"kinesis":     func() DataSource { return &kinesisacquisition.KinesisSource{} },
	"wineventlog": func() DataSource { return &wineventlogacquisition.WinEventLogSource{} },
	"kafka":       func() DataSource { return &kafkaacquisition.KafkaSource{} },
	"k8s-audit":   func() DataSource { return &k8sauditacquisition.KubernetesAuditSource{} },
	"s3":          func() DataSource { return &s3acquisition.S3Source{} },
}

Functions

func GetMetrics

func GetMetrics(sources []DataSource, aggregated bool) error

func StartAcquisition

func StartAcquisition(sources []DataSource, output chan types.Event, AcquisTomb *tomb.Tomb) error

Types

type DataSource

type DataSource interface {
	GetMetrics() []prometheus.Collector                                 // Returns pointers to metrics that are managed by the module
	GetAggregMetrics() []prometheus.Collector                           // Returns pointers to metrics that are managed by the module (aggregated mode, limits cardinality)
	UnmarshalConfig([]byte) error                                       // Decode and pre-validate the YAML datasource - anything that can be checked before runtime
	Configure([]byte, *log.Entry) error                                 // Complete the YAML datasource configuration and perform runtime checks.
	ConfigureByDSN(string, map[string]string, *log.Entry, string) error // Configure the datasource
	GetMode() string                                                    // Get the mode (TAIL, CAT or SERVER)
	GetName() string                                                    // Get the name of the module
	OneShotAcquisition(chan types.Event, *tomb.Tomb) error              // Start one shot acquisition(eg, cat a file)
	StreamingAcquisition(chan types.Event, *tomb.Tomb) error            // Start live acquisition (eg, tail a file)
	CanRun() error                                                      // Whether the datasource can run or not (eg, journalctl on BSD is a non-sense)
	GetUuid() string                                                    // Get the unique identifier of the datasource
	Dump() interface{}
}

The interface each datasource must implement

func DataSourceConfigure

func DataSourceConfigure(commonConfig configuration.DataSourceCommonCfg) (*DataSource, error)

func GetDataSourceIface

func GetDataSourceIface(dataSourceType string) DataSource

func LoadAcquisitionFromDSN

func LoadAcquisitionFromDSN(dsn string, labels map[string]string, transformExpr string) ([]DataSource, error)

func LoadAcquisitionFromFile

func LoadAcquisitionFromFile(config *csconfig.CrowdsecServiceCfg) ([]DataSource, error)

LoadAcquisitionFromFile unmarshals the configuration item and checks its availability