acquisition

Documentation

Index

• Variables
• func GetMetrics(sources []DataSource, aggregated bool) error
• func GetMetricsLevelFromPromCfg(prom *csconfig.PrometheusCfg) int
• func StartAcquisition(sources []DataSource, output chan types.Event, AcquisTomb *tomb.Tomb) error
• type DataSource
  • func DataSourceConfigure(commonConfig configuration.DataSourceCommonCfg, metricsLevel int) (*DataSource, error)
  • func GetDataSourceIface(dataSourceType string) DataSource
  • func LoadAcquisitionFromDSN(dsn string, labels map[string]string, transformExpr string) ([]DataSource, error)
  • func LoadAcquisitionFromFile(config *csconfig.CrowdsecServiceCfg, prom *csconfig.PrometheusCfg) ([]DataSource, error)
• type DataSourceUnavailableError
  • func (e *DataSourceUnavailableError) Error() string
  • func (e *DataSourceUnavailableError) Unwrap() error

Variables

var AcquisitionSources = map[string]func() DataSource{
	"file":        func() DataSource { return &fileacquisition.FileSource{} },
	"journalctl":  func() DataSource { return &journalctlacquisition.JournalCtlSource{} },
	"cloudwatch":  func() DataSource { return &cloudwatchacquisition.CloudwatchSource{} },
	"syslog":      func() DataSource { return &syslogacquisition.SyslogSource{} },
	"docker":      func() DataSource { return &dockeracquisition.DockerSource{} },
	"kinesis":     func() DataSource { return &kinesisacquisition.KinesisSource{} },
	"wineventlog": func() DataSource { return &wineventlogacquisition.WinEventLogSource{} },
	"kafka":       func() DataSource { return &kafkaacquisition.KafkaSource{} },
	"k8s-audit":   func() DataSource { return &k8sauditacquisition.KubernetesAuditSource{} },
	"loki":        func() DataSource { return &lokiacquisition.LokiSource{} },
	"s3":          func() DataSource { return &s3acquisition.S3Source{} },
	"appsec":      func() DataSource { return &appsecacquisition.AppsecSource{} },
}

Functions

func GetMetrics

func GetMetrics(sources []DataSource, aggregated bool) error

func GetMetricsLevelFromPromCfg

func GetMetricsLevelFromPromCfg(prom *csconfig.PrometheusCfg) int

func StartAcquisition

func StartAcquisition(sources []DataSource, output chan types.Event, AcquisTomb *tomb.Tomb) error

Types

type DataSource

type DataSource interface {
	GetMetrics() []prometheus.Collector                                 // Returns pointers to metrics that are managed by the module
	GetAggregMetrics() []prometheus.Collector                           // Returns pointers to metrics that are managed by the module (aggregated mode, limits cardinality)
	UnmarshalConfig([]byte) error                                       // Decode and pre-validate the YAML datasource - anything that can be checked before runtime
	Configure([]byte, *log.Entry, int) error                            // Complete the YAML datasource configuration and perform runtime checks.
	ConfigureByDSN(string, map[string]string, *log.Entry, string) error // Configure the datasource
	GetMode() string                                                    // Get the mode (TAIL, CAT or SERVER)
	GetName() string                                                    // Get the name of the module
	OneShotAcquisition(chan types.Event, *tomb.Tomb) error              // Start one shot acquisition(eg, cat a file)
	StreamingAcquisition(chan types.Event, *tomb.Tomb) error            // Start live acquisition (eg, tail a file)
	CanRun() error                                                      // Whether the datasource can run or not (eg, journalctl on BSD is a non-sense)
	GetUuid() string                                                    // Get the unique identifier of the datasource
	Dump() interface{}
}

The interface each datasource must implement

func DataSourceConfigure

func DataSourceConfigure(commonConfig configuration.DataSourceCommonCfg, metricsLevel int) (*DataSource, error)

DataSourceConfigure creates and returns a DataSource object from a configuration, if the configuration is not valid it returns an error. If the datasource can't be run (eg. journalctl not available), it still returns an error which can be checked for the appropriate action.

func GetDataSourceIface

func GetDataSourceIface(dataSourceType string) DataSource

func LoadAcquisitionFromDSN

func LoadAcquisitionFromDSN(dsn string, labels map[string]string, transformExpr string) ([]DataSource, error)

func LoadAcquisitionFromFile

func LoadAcquisitionFromFile(config *csconfig.CrowdsecServiceCfg, prom *csconfig.PrometheusCfg) ([]DataSource, error)

LoadAcquisitionFromFile unmarshals the configuration item and checks its availability

type DataSourceUnavailableError

type DataSourceUnavailableError struct {
	Name string
	Err  error
}

func (*DataSourceUnavailableError) Error

func (e *DataSourceUnavailableError) Error() string

func (*DataSourceUnavailableError) Unwrap

func (e *DataSourceUnavailableError) Unwrap() error