common

Documentation

Index

• Constants
• Variables
• type DataStream
• type DataStreamHints
• type ParsedEvent
• type S3DataStreamHints
• type S3Notification

Constants

const (
	LogData    = "LogData"
	RuleOutput = "RuleOutput"
)

const (
	OpLogNamespace  = "Panther" // FIXME: move "up" in the stack
	OpLogComponent  = "LogProcessor"
	OpLogServiceDim = "Service"
)

labels for oplog

const (
	MaxRetries = 20 // setting Max Retries to a higher number - we'd like to retry VERY hard before failing.
)

Variables

var (
	OpLogManager = oplog.NewManager(OpLogNamespace, OpLogComponent)

	OpLogLambdaServiceDim    = zap.String(OpLogServiceDim, "lambda")
	OpLogS3ServiceDim        = zap.String(OpLogServiceDim, "s3")
	OpLogSNSServiceDim       = zap.String(OpLogServiceDim, "sns")
	OpLogProcessorServiceDim = zap.String(OpLogServiceDim, "processor")
	OpLogGlueServiceDim      = zap.String(OpLogServiceDim, "glue")
)

var Session = session.Must(session.NewSession(aws.NewConfig().WithMaxRetries(MaxRetries)))

Session AWS Session that can be used by components of the system

Types

type DataStream

type DataStream struct {
	Reader io.Reader
	Hints  DataStreamHints
	// The log type if known
	// If it is nil, it means the log type hasn't been identified yet
	LogType *string
}

DataStream represents a data stream that read by the processor

type DataStreamHints

type DataStreamHints struct {
	S3 *S3DataStreamHints // if nil, no hint
}

Used in a DataStream as meta data to describe the data

type ParsedEvent

type ParsedEvent struct {
	Event   interface{} `json:"event"`
	LogType string      `json:"logType"`
}

ParsedEvent contains a single event that has already been processed

type S3DataStreamHints

type S3DataStreamHints struct {
	Bucket      string
	Key         string
	ContentType string
}

Used in a DataStreamHints as meta data to describe the S3 object backing the stream

type S3Notification

type S3Notification struct {
	// S3Bucket is name of the S3 Bucket where data is available
	S3Bucket *string `json:"s3Bucket"`
	// S3ObjectKey is the key of the S3 object that contains the new data
	S3ObjectKey *string `json:"s3ObjectKey"`
	// Events is the number of events in the S3 object
	Events *int `json:"events"`
	// Bytes is the uncompressed size in bytes of the S3 object
	Bytes *int `json:"bytes"`
	// Type is the type of data available in the S3 object (LogData,RuleOutput)
	Type *string `json:"type"`
	// ID is an identified for the data in the S3 object. In case of LogData this will be
	// the Log Type, in case of RuleOutput data this will be the RuleID
	ID *string `json:"id"`
}

S3Notification is sent when new data is available in S3