acquisition

Documentation

Index

• Variables
• func StartAcquisition(sources []DataSource, output chan types.Event, AcquisTomb *tomb.Tomb) error
• type DataSource
  • func DataSourceConfigure(config DataSourceCfg) (DataSource, error)
  • func LoadAcquisitionFromFile(config *csconfig.CrowdsecServiceCfg) ([]DataSource, error)
• type DataSourceCfg
• type FileSource
  • func (f *FileSource) CatOneFile(output chan types.Event, AcquisTomb *tomb.Tomb, idx int) error
  • func (f *FileSource) Configure(Config DataSourceCfg) error
  • func (f *FileSource) Mode() string
  • func (f *FileSource) StartCat(output chan types.Event, AcquisTomb *tomb.Tomb) error
  • func (f *FileSource) StartReading(out chan types.Event, t *tomb.Tomb) error
  • func (f *FileSource) StartTail(output chan types.Event, AcquisTomb *tomb.Tomb) error
  • func (f *FileSource) TailOneFile(output chan types.Event, AcquisTomb *tomb.Tomb, idx int) error
• type JournaldSource
  • func (j *JournaldSource) Configure(config DataSourceCfg) error
  • func (j *JournaldSource) Mode() string
  • func (j *JournaldSource) StartCat(out chan types.Event, t *tomb.Tomb) error
  • func (j *JournaldSource) StartReading(out chan types.Event, t *tomb.Tomb) error
  • func (j *JournaldSource) StartTail(out chan types.Event, t *tomb.Tomb) error

Variables

var CAT_MODE = "cat"

var JOURNALD_CMD = "journalctl"

var JOURNALD_DEFAULT_CAT_ARGS = []string{}

var JOURNALD_DEFAULT_TAIL_ARGS = []string{"--follow"}

var ReaderHits = prometheus.NewCounterVec(
	prometheus.CounterOpts{
		Name: "cs_reader_hits_total",
		Help: "Total lines where read.",
	},
	[]string{"source"},
)

var TAIL_MODE = "tail"

Functions

func StartAcquisition

func StartAcquisition(sources []DataSource, output chan types.Event, AcquisTomb *tomb.Tomb) error

Types

type DataSource

type DataSource interface {
	Configure(DataSourceCfg) error
	/*the readers must watch the tomb (especially in tail mode) to know when to shutdown.
	tomb is as well used to trigger general shutdown when a datasource errors */
	StartReading(chan types.Event, *tomb.Tomb) error
	Mode() string //return CAT_MODE or TAIL_MODE

}

func DataSourceConfigure

func DataSourceConfigure(config DataSourceCfg) (DataSource, error)

func LoadAcquisitionFromFile

func LoadAcquisitionFromFile(config *csconfig.CrowdsecServiceCfg) ([]DataSource, error)

type DataSourceCfg

type DataSourceCfg struct {
	Mode              string            `yaml:"mode,omitempty"` //tail|cat|...
	Filename          string            `yaml:"filename,omitempty"`
	Filenames         []string          `yaml:"filenames,omitempty"`
	JournalctlFilters []string          `yaml:"journalctl_filter,omitempty"`
	Labels            map[string]string `yaml:"labels,omitempty"`
	Profiling         bool              `yaml:"profiling,omitempty"`
}

type FileSource

type FileSource struct {
	Config DataSourceCfg

	Files []string
	// contains filtered or unexported fields
}

func (*FileSource) CatOneFile

func (f *FileSource) CatOneFile(output chan types.Event, AcquisTomb *tomb.Tomb, idx int) error

A one shot file reader (cat)

func (*FileSource) Configure

func (f *FileSource) Configure(Config DataSourceCfg) error

func (*FileSource) Mode

func (f *FileSource) Mode() string

func (*FileSource) StartCat

func (f *FileSource) StartCat(output chan types.Event, AcquisTomb *tomb.Tomb) error

A one shot file reader (cat)

func (*FileSource) StartReading

func (f *FileSource) StartReading(out chan types.Event, t *tomb.Tomb) error

func (*FileSource) StartTail

func (f *FileSource) StartTail(output chan types.Event, AcquisTomb *tomb.Tomb) error

A tail-mode file reader (tail)

func (*FileSource) TailOneFile

func (f *FileSource) TailOneFile(output chan types.Event, AcquisTomb *tomb.Tomb, idx int) error

A tail-mode file reader (tail)

type JournaldSource

type JournaldSource struct {
	Config  DataSourceCfg
	Cmd     *exec.Cmd
	Stdout  io.ReadCloser
	Stderr  io.ReadCloser
	Decoder *json.Decoder
	SrcName string
}

func (*JournaldSource) Configure

func (j *JournaldSource) Configure(config DataSourceCfg) error

func (*JournaldSource) Mode

func (j *JournaldSource) Mode() string

func (*JournaldSource) StartCat

func (j *JournaldSource) StartCat(out chan types.Event, t *tomb.Tomb) error

func (*JournaldSource) StartReading

func (j *JournaldSource) StartReading(out chan types.Event, t *tomb.Tomb) error

func (*JournaldSource) StartTail

func (j *JournaldSource) StartTail(out chan types.Event, t *tomb.Tomb) error