eventlog

Documentation

Overview

Package eventlog provides the means for reading event logs from Windows. Windows has two different APIs for reading event logs. This package automatically chooses the appropriate API to use based on what is available in the runtime operating system.

Index

• func Register(apiName string, priority int, producer producer, channels channels)
• type ConfigCommon
• type EventLog
  • func New(options *common.Config) (EventLog, error)
• type Record
  • func (e Record) ToEvent() beat.Event

Functions

func Register

func Register(apiName string, priority int, producer producer, channels channels)

Register registers an EventLog API. Only the APIs that are available for the runtime OS should be registered. Each API must have a unique priority.

Types

type ConfigCommon

type ConfigCommon struct {
	API  string `config:"api"`  // Name of the API to use. Optional.
	Name string `config:"name"` // Name of the event log or channel.
}

ConfigCommon is the common configuration data used to instantiate a new EventLog. Each implementation is free to support additional configuration options.

type EventLog

type EventLog interface {
	// Open the event log. recordNumber is the last successfully read event log
	// record number. Read will resume from recordNumber + 1. To start reading
	// from the first event specify a recordNumber of 0.
	Open(recordNumber uint64) error

	// Read records from the event log.
	Read() ([]Record, error)

	// Close the event log. It should not be re-opened after closing.
	Close() error

	// Name returns the event log's name.
	Name() string
}

EventLog is an interface to a Windows Event Log.

func New

func New(options *common.Config) (EventLog, error)

New creates and returns a new EventLog instance based on the given config and the registered EventLog producers.

type Record

type Record struct {
	sys.Event
	API string // The event log API type used to read the record.
	XML string // XML representation of the event.
}

Record represents a single event from the log.

func (Record) ToEvent

func (e Record) ToEvent() beat.Event

ToMapStr returns a new MapStr containing the data from this Record.