Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Classifier ¶
type Classifier struct {
// contains filtered or unexported fields
}
Classifier is the struct responsible for classifying logs
func (*Classifier) Classify ¶
func (c *Classifier) Classify(log string) *ClassifierResult
Classify attempts to classify the provided log line
func (*Classifier) ParserStats ¶
func (c *Classifier) ParserStats() map[string]*ParserStats
func (*Classifier) Stats ¶
func (c *Classifier) Stats() *ClassifierStats
type ClassifierAPI ¶
type ClassifierAPI interface {
// Classify attempts to classify the provided log line
Classify(log string) *ClassifierResult
// aggregate stats
Stats() *ClassifierStats
// per-parser stats, map of LogType -> stats
ParserStats() map[string]*ParserStats
}
ClassifierAPI is the interface for a classifier
func NewClassifier ¶
func NewClassifier() ClassifierAPI
NewClassifier returns a new instance of a ClassifierAPI implementation
type ClassifierResult ¶
type ClassifierResult struct {
// Events contains the parsed events
// If the classification process was not successful and the log is from an
// unsupported type, this will be nil
Events []*parsers.PantherLog
// LogType is the identified type of the log
LogType *string
}
ClassifierResult is the result of the ClassifierAPI#Classify method
type ClassifierStats ¶
type ClassifierStats struct {
ClassifyTimeMicroseconds uint64 // total time parsing
BytesProcessedCount uint64 // input bytes
LogLineCount uint64 // input records
EventCount uint64 // output records
SuccessfullyClassifiedCount uint64
ClassificationFailureCount uint64
}
aggregate stats
type ParserPriorityQueue ¶
type ParserPriorityQueue struct {
// contains filtered or unexported fields
}
ParserPriorityQueue contains parsers in priority order
func (*ParserPriorityQueue) Len ¶
func (q *ParserPriorityQueue) Len() int
Len returns the length of the priority queue
func (*ParserPriorityQueue) Less ¶
func (q *ParserPriorityQueue) Less(i, j int) bool
Less compares two items of the priority queue
func (*ParserPriorityQueue) Peek ¶
func (q *ParserPriorityQueue) Peek() *ParserQueueItem
Peek returns the item with the higher priority without removing it
func (*ParserPriorityQueue) Pop ¶
func (q *ParserPriorityQueue) Pop() interface{}
Pop removes the last element of the queue
func (*ParserPriorityQueue) Push ¶
func (q *ParserPriorityQueue) Push(x interface{})
Push adds an element to the end of the SchemaQueue
func (*ParserPriorityQueue) Swap ¶
func (q *ParserPriorityQueue) Swap(i, j int)
Swap swaps two items in the priority queue
type ParserQueueItem ¶
type ParserQueueItem struct {
// contains filtered or unexported fields
}
ParserQueueItem contains all the information needed to initialize a schema.
Source Files