Documentation ¶
Index ¶
- type CatEvaluator
- type CatEvaluatorKind
- type CompareCondRepo
- func (repo *CompareCondRepo) ConvertToCategoryCondition(c condition.Condition, parentScope *ForEachScope) condition.Condition
- func (repo *CompareCondRepo) DiscardEvalCategoryRec(evalCategoryRec *EvalCategoryRec)
- func (repo *CompareCondRepo) NewEvalCategoryRec(eval condition.Operand) *EvalCategoryRec
- type EvalCategoryRec
- type EvalCondFunc
- type ExternalRule
- type ForEachScope
- type GeneralRuleRecord
- type InternalRule
- type RepoInterface
- type RuleApi
- type RuleEngine
- type RuleEngineMetrics
- type RuleEngineRepo
- func (repo *RuleEngineRepo) GetAppCtx() *types.AppContext
- func (repo *RuleEngineRepo) MapScalar(v interface{}) interface{}
- func (repo *RuleEngineRepo) Register(f *InternalRule) uint
- func (repo *RuleEngineRepo) RegisterRuleFromString(rule string, format string) (uint, error)
- func (repo *RuleEngineRepo) RegisterRulesFromFile(path string) ([]uint, error)
- type StringMatcher
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CatEvaluator ¶
type CatEvaluator interface { Evaluate(event *objectmap.ObjectAttributeMap, frames []interface{}) (bool, error) GetCategory() types.Category immutable.SetElement }
type CatEvaluatorKind ¶
type CatEvaluatorKind int8
type CompareCondRepo ¶
type CompareCondRepo struct { AttributeToCompareCondRecord map[string]*hashset.Set[*EvalCategoryRec] CondToCompareCondRecord *hashmap.Map[condition.Condition, *EvalCategoryRec] CondToCategoryMap *hashmap.Map[condition.Condition, *hashmap.Map[condition.Operand, []condition.Operand]] CondToStringMatcher *hashmap.Map[condition.Condition, *StringMatcher] EvalCategoryRecs []*EvalCategoryRec RuleRepo condition.RuleRepo ObjectAttributeMapper *objectmap.ObjectAttributeMapper CondFactory *condition.Factory // contains filtered or unexported fields }
CompareCondRepo contains mappings between filter Compare Conditions and attributes assigned to them. Identical Compare Conditions will be mapped to the same category.
func RuleEngineRepoToCompareCondRepo ¶
func RuleEngineRepoToCompareCondRepo(repo *RuleEngineRepo) (*CompareCondRepo, error)
func (*CompareCondRepo) ConvertToCategoryCondition ¶
func (repo *CompareCondRepo) ConvertToCategoryCondition(c condition.Condition, parentScope *ForEachScope) condition.Condition
ConvertToCategoryCondition this has to be called from the root condition or and/or/not boolean operator
func (*CompareCondRepo) DiscardEvalCategoryRec ¶
func (repo *CompareCondRepo) DiscardEvalCategoryRec(evalCategoryRec *EvalCategoryRec)
func (*CompareCondRepo) NewEvalCategoryRec ¶
func (repo *CompareCondRepo) NewEvalCategoryRec(eval condition.Operand) *EvalCategoryRec
type EvalCategoryRec ¶
func (*EvalCategoryRec) Equals ¶
func (v *EvalCategoryRec) Equals(element immutable.SetElement) bool
func (*EvalCategoryRec) Evaluate ¶
func (v *EvalCategoryRec) Evaluate(event *objectmap.ObjectAttributeMap, frames []interface{}) condition.Operand
func (*EvalCategoryRec) GetCategory ¶
func (v *EvalCategoryRec) GetCategory() types.Category
func (*EvalCategoryRec) GetHash ¶
func (v *EvalCategoryRec) GetHash() uint64
type EvalCondFunc ¶
type EvalCondFunc func(event *objectmap.ObjectAttributeMap, frames []interface{}) (bool, error)
type ExternalRule ¶
type ForEachScope ¶
type ForEachScope struct { // Path, e.g. $.members or $member.children. // Each path consist of the outer path reference (e.g. $ for root or $member for path to // the member element) and the path to a nested array element. The address of the denoted // element is therefore a concatenation of the address of the parent element's path // and the address of the path of the current element. Path string Element string NestingLevel int ParentScope *ForEachScope Evaluator *EvalCategoryRec AttrDictRec *objectmap.AttrDictionaryRec }
ForEachScope keeps track of the local scope data. Each for_all, for_some or for_each filter element starts a new scope with its index element and path pointing to the data attribute over which the element iterates in this scope. The scope's element is available from all the nested scopes both during the filter build time as the parentScope parameter and at runtime via array of attribute addresses, one for each ancestor scope.
func (*ForEachScope) ResetEvaluator ¶
func (scope *ForEachScope) ResetEvaluator()
type GeneralRuleRecord ¶
type GeneralRuleRecord struct {
// contains filtered or unexported fields
}
type InternalRule ¶
type RepoInterface ¶
type RepoInterface interface {
Register(f *InternalRule)
}
type RuleApi ¶
type RuleApi struct {
// contains filtered or unexported fields
}
func NewRuleApi ¶
func NewRuleApi(ctx *types.AppContext) *RuleApi
type RuleEngine ¶
type RuleEngine struct { Metrics RuleEngineMetrics // contains filtered or unexported fields }
func NewRuleEngine ¶
func NewRuleEngine(repo *RuleEngineRepo) (*RuleEngine, error)
func (*RuleEngine) GetRuleDefinition ¶
func (f *RuleEngine) GetRuleDefinition(ruleId uint) *InternalRule
func (*RuleEngine) MatchEvent ¶
func (f *RuleEngine) MatchEvent(v interface{}) []condition.RuleIdType
type RuleEngineMetrics ¶
type RuleEngineMetrics struct {
NumCatEvals uint64
}
type RuleEngineRepo ¶
type RuleEngineRepo struct { Rules []*GeneralRuleRecord // contains filtered or unexported fields }
func NewRuleEngineRepo ¶
func NewRuleEngineRepo() *RuleEngineRepo
func (*RuleEngineRepo) GetAppCtx ¶
func (repo *RuleEngineRepo) GetAppCtx() *types.AppContext
func (*RuleEngineRepo) MapScalar ¶
func (repo *RuleEngineRepo) MapScalar(v interface{}) interface{}
MapScalar Implement MapperConfig interface
func (*RuleEngineRepo) Register ¶
func (repo *RuleEngineRepo) Register(f *InternalRule) uint
func (*RuleEngineRepo) RegisterRuleFromString ¶
func (repo *RuleEngineRepo) RegisterRuleFromString(rule string, format string) (uint, error)
func (*RuleEngineRepo) RegisterRulesFromFile ¶ added in v0.2.0
func (repo *RuleEngineRepo) RegisterRulesFromFile(path string) ([]uint, error)
type StringMatcher ¶
type StringMatcher struct {
// contains filtered or unexported fields
}
func NewStringMatcher ¶
func NewStringMatcher() *StringMatcher
func (*StringMatcher) AddPattern ¶
func (sm *StringMatcher) AddPattern(pattern string, category condition.Operand)
func (*StringMatcher) Build ¶
func (sm *StringMatcher) Build()