processors

Documentation

Index

• Variables
• func Plugin(name string, c Constructor) map[string][]interface{}
• func RegisterPlugin(name string, constructor Constructor)
• type Condition
  • func NewCondition(config *ConditionConfig) (*Condition, error)
  • func NewConditionList(config []ConditionConfig) ([]Condition, error)
  • func (c *Condition) Check(event ValuesMap) bool
  • func (c Condition) String() string
• type ConditionConfig
• type ConditionFields
  • func (f *ConditionFields) Unpack(to interface{}) error
• type Constructor
  • func NewConditional(ruleFactory Constructor) Constructor
• type EqualsValue
  • func (e EqualsValue) String() string
• type Namespace
  • func NewNamespace() *Namespace
  • func (ns *Namespace) Plugin() Constructor
  • func (ns *Namespace) Register(name string, factory Constructor) error
• type PluginConfig
• type Processor
  • func NewConditionRule(config ConditionConfig, p Processor) (Processor, error)
• type Processors
  • func New(config PluginConfig) (*Processors, error)
  • func (procs *Processors) All() []beat.Processor
  • func (procs *Processors) Run(event *beat.Event) *beat.Event
  • func (procs *Processors) RunBC(event common.MapStr) common.MapStr
  • func (procs Processors) String() string
• type RangeValue
  • func (r RangeValue) String() string
• type ValuesMap
• type WhenProcessor
  • func (r *WhenProcessor) Run(event *beat.Event) (*beat.Event, error)
  • func (r *WhenProcessor) String() string

Variables

var MandatoryExportedFields = []string{"type"}

fields that should be always exported

Functions

func Plugin

func Plugin(name string, c Constructor) map[string][]interface{}

func RegisterPlugin

func RegisterPlugin(name string, constructor Constructor)

Types

type Condition

type Condition struct {
	// contains filtered or unexported fields
}

func NewCondition

func NewCondition(config *ConditionConfig) (*Condition, error)

func NewConditionList

func NewConditionList(config []ConditionConfig) ([]Condition, error)

func (*Condition) Check

func (c *Condition) Check(event ValuesMap) bool

func (Condition) String

func (c Condition) String() string

type ConditionConfig

type ConditionConfig struct {
	Equals   *ConditionFields  `config:"equals"`
	Contains *ConditionFields  `config:"contains"`
	Regexp   *ConditionFields  `config:"regexp"`
	Range    *ConditionFields  `config:"range"`
	OR       []ConditionConfig `config:"or"`
	AND      []ConditionConfig `config:"and"`
	NOT      *ConditionConfig  `config:"not"`
}

type ConditionFields

type ConditionFields struct {
	// contains filtered or unexported fields
}

func (*ConditionFields) Unpack

func (f *ConditionFields) Unpack(to interface{}) error

type Constructor

type Constructor func(config *common.Config) (Processor, error)

func NewConditional

func NewConditional(
	ruleFactory Constructor,
) Constructor

type EqualsValue

type EqualsValue struct {
	Int uint64
	Str string
}

func (EqualsValue) String

func (e EqualsValue) String() string

type Namespace

type Namespace struct {
	// contains filtered or unexported fields
}

func NewNamespace

func NewNamespace() *Namespace

func (*Namespace) Plugin

func (ns *Namespace) Plugin() Constructor

func (*Namespace) Register

func (ns *Namespace) Register(name string, factory Constructor) error

type PluginConfig

type PluginConfig []map[string]*common.Config

type Processor

type Processor interface {
	Run(event *beat.Event) (*beat.Event, error)
	String() string
}

func NewConditionRule

func NewConditionRule(
	config ConditionConfig,
	p Processor,
) (Processor, error)

type Processors

type Processors struct {
	List []Processor
}

func New

func New(config PluginConfig) (*Processors, error)

func (*Processors) All

func (procs *Processors) All() []beat.Processor

func (*Processors) Run

func (procs *Processors) Run(event *beat.Event) *beat.Event

Applies a sequence of processing rules and returns the filtered event

func (*Processors) RunBC

func (procs *Processors) RunBC(event common.MapStr) common.MapStr

RunBC (run backwards-compatible) applies the processors, by providing the old interface based on common.MapStr. The event us temporarily converted to beat.Event. By this 'conversion' the '@timestamp' field can not be accessed by processors. Note: this method will be removed, when the publisher pipeline BC-API is to

be removed.

func (Processors) String

func (procs Processors) String() string

type RangeValue

type RangeValue struct {
	// contains filtered or unexported fields
}

func (RangeValue) String

func (r RangeValue) String() string

type ValuesMap

type ValuesMap interface {
	// GetValue returns the given field from the map
	GetValue(string) (interface{}, error)
}

ValuesMap provides a common interface to read fields for condition checking

type WhenProcessor

type WhenProcessor struct {
	// contains filtered or unexported fields
}

func (*WhenProcessor) Run

func (r *WhenProcessor) Run(event *beat.Event) (*beat.Event, error)

func (*WhenProcessor) String

func (r *WhenProcessor) String() string