sources

Documentation

Index

• Constants
• func BuildClassifier(src *models.SourceIntegration, r logtypes.Resolver) (classification.ClassifierAPI, error)
• func ConfirmSubscription(notification *SnsNotification) (err error)
• func LoadSource(id string) (*models.SourceIntegration, error)
• func LoadSourceS3(bucketName, objectKey string) (*models.SourceIntegration, error)
• func ReadSnsMessage(ctx context.Context, message string) (result []*common.DataStream, err error)
• type ErrUnsupportedFileType
  • func (e *ErrUnsupportedFileType) Error() string
• type MessageForwarderReader
  • func NewMessageForwarderReader(input io.Reader) *MessageForwarderReader
  • func (r *MessageForwarderReader) Read(p []byte) (n int, err error)
• type S3ObjectInfo
  • func ParseNotification(message string) ([]*S3ObjectInfo, error)
• type SQSClassifier
  • func (c *SQSClassifier) Classify(log string) (*classification.ClassifierResult, error)
  • func (c *SQSClassifier) ParserStats() map[string]*classification.ParserStats
  • func (c *SQSClassifier) Stats() *classification.ClassifierStats
• type SnsNotification

Constants

const (
	DownloadMaxPartSize = 50 * 1024 * 1024 // the max size of in memory buffers will be 3X as this due to multiple buffers

)

Functions

func BuildClassifier

func BuildClassifier(src *models.SourceIntegration, r logtypes.Resolver) (classification.ClassifierAPI, error)

BuildClassifier builds a classifier for a source

func ConfirmSubscription

func ConfirmSubscription(notification *SnsNotification) (err error)

ConfirmSubscription will confirm the SNS->SQS subscription

func LoadSource

func LoadSource(id string) (*models.SourceIntegration, error)

LoadSource loads the source configuration for an source id. This will update the global cache if needed. It will return error if it encountered an issue retrieving the source information or if the source is not found.

func LoadSourceS3

func LoadSourceS3(bucketName, objectKey string) (*models.SourceIntegration, error)

LoadSourceS3 loads the source configuration for an S3 object. It will update the global cache if needed It will return error if it encountered an issue retrieving the source information or if the source is not found.

func ReadSnsMessage

func ReadSnsMessage(ctx context.Context, message string) (result []*common.DataStream, err error)

ReadSnsMessage reads incoming messages containing SNS notifications and returns a slice of DataStream items

Types

type ErrUnsupportedFileType

type ErrUnsupportedFileType struct {
	Type string
}

ErrUnsupportedFileType is returned when the log processor encounters a file type that is not supported and cannot process

func (*ErrUnsupportedFileType) Error

func (e *ErrUnsupportedFileType) Error() string

type MessageForwarderReader

type MessageForwarderReader struct {
	// contains filtered or unexported fields
}

func NewMessageForwarderReader

func NewMessageForwarderReader(input io.Reader) *MessageForwarderReader

Reader for messages sent by the Message Forwarder Lambda

func (*MessageForwarderReader) Read

func (r *MessageForwarderReader) Read(p []byte) (n int, err error)

type S3ObjectInfo

type S3ObjectInfo struct {
	S3Bucket     string
	S3ObjectKey  string
	S3ObjectSize int64
}

S3ObjectInfo contains information about the S3 object

func ParseNotification

func ParseNotification(message string) ([]*S3ObjectInfo, error)

ParseNotification parses a message received

type SQSClassifier

type SQSClassifier struct {
	Resolver   logtypes.Resolver
	LoadSource func(id string) (*models.SourceIntegration, error)
	// contains filtered or unexported fields
}

func (*SQSClassifier) Classify

func (c *SQSClassifier) Classify(log string) (*classification.ClassifierResult, error)

func (*SQSClassifier) ParserStats

func (c *SQSClassifier) ParserStats() map[string]*classification.ParserStats

func (*SQSClassifier) Stats

func (c *SQSClassifier) Stats() *classification.ClassifierStats

type SnsNotification

type SnsNotification struct {
	events.SNSEntity
	Token *string `json:"Token"`
}

SnsNotification struct represents an SNS message arriving to Panther SQS from a customer account. The message can either be of type 'Notification' or 'SubscriptionConfirmation' Since there is no AWS SDK-provided struct to represent both types we had to create this custom type to include fields from both types.