query

Documentation

Index

• Variables
• func ToPathName(in string) string
• func ToProtocolKeyword(in any) string
• func ToTcpFlagNames(in string) []string
• func ToTime(in string) string
• type FlowLogFields
  • func (f FlowLogFields) Format() string
• type Query
  • func NewQuery(limit, sinceMinutes int) Query
  • func (q Query) Accept() Query
  • func (q Query) Address(addr string) Query
  • func (q Query) DestinationAddress(addr string) Query
  • func (q Query) DestinationPort(port int) Query
  • func (q Query) Egress() Query
  • func (q Query) GetLimit() int
  • func (q Query) GetQuery() string
  • func (q Query) GetSinceMinutes() int
  • func (q Query) Ingress() Query
  • func (q Query) InterfaceId(id string) Query
  • func (q Query) NoNoData() Query
  • func (q Query) NoSkipData() Query
  • func (q Query) PktDestinationAddress(addr string) Query
  • func (q Query) PktSourceAddress(addr string) Query
  • func (q Query) Port(port int) Query
  • func (q Query) Protocol(proto string) Query
  • func (q Query) Reject() Query
  • func (q Query) Sort() Query
  • func (q Query) SourceAddress(addr string) Query
  • func (q Query) SourcePort(port int) Query

Variables

var Fields = []string{
	"@timestamp", "interfaceId", "srcAddr", "dstAddr", "srcPort", "dstPort", "protocol", "packets", "bytes",
	"action",
	"tcpFlags", "pktSrcAddr", "pktDstAddr",
	"flowDirection", "trafficPath",
	"ecsServiceName",
}

Fields used when querying flow logs (unsurprisingly naming convention is different from the above fields)

var FlowLogFieldsV2V5 = FlowLogFields{
	"interface-id", "srcaddr", "dstaddr", "srcport", "dstport", "protocol", "packets", "bytes", "start", "end",
	"action", "log-status",
	"vpc-id", "subnet-id", "instance-id", "tcp-flags", "type", "pkt-srcaddr", "pkt-dstaddr",
	"pkt-src-aws-service", "pkt-dst-aws-service", "flow-direction", "traffic-path",
}

FlowLogFieldsV2V5 used when creating flow logs - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

var FlowLogFieldsV7 = FlowLogFields{
	"ecs-cluster-arn", "ecs-cluster-name", "ecs-container-instance-arn", "ecs-container-instance-id", "ecs-container-id",
	"ecs-second-container-id", "ecs-service-name", "ecs-task-definition-arn", "ecs-task-arn", "ecs-task-id",
}

FlowLogFieldsV7 V7 fields can only be created if there is at least one ECS cluster in VPC this is another crazy half-baked product by AWS, what if we want to create ECS cluster after?

Functions

func ToPathName

func ToPathName(in string) string

ToPathName takes traffic-path flow log field and return name representation. This applies only to egress traffic

func ToProtocolKeyword

func ToProtocolKeyword(in any) string

func ToTcpFlagNames

func ToTcpFlagNames(in string) []string

func ToTime

func ToTime(in string) string

Types

type FlowLogFields

type FlowLogFields []string

func (FlowLogFields) Format

func (f FlowLogFields) Format() string

type Query

type Query struct {
	// contains filtered or unexported fields
}

Query is request to query cloud watch flow logs

func NewQuery

func NewQuery(limit, sinceMinutes int) Query

func (Query) Accept

func (q Query) Accept() Query

func (Query) Address

func (q Query) Address(addr string) Query

func (Query) DestinationAddress

func (q Query) DestinationAddress(addr string) Query

func (Query) DestinationPort

func (q Query) DestinationPort(port int) Query

func (Query) Egress

func (q Query) Egress() Query

func (Query) GetLimit

func (q Query) GetLimit() int

func (Query) GetQuery

func (q Query) GetQuery() string

func (Query) GetSinceMinutes

func (q Query) GetSinceMinutes() int

func (Query) Ingress

func (q Query) Ingress() Query

func (Query) InterfaceId

func (q Query) InterfaceId(id string) Query

func (Query) NoNoData

func (q Query) NoNoData() Query

func (Query) NoSkipData

func (q Query) NoSkipData() Query

func (Query) PktDestinationAddress

func (q Query) PktDestinationAddress(addr string) Query

func (Query) PktSourceAddress

func (q Query) PktSourceAddress(addr string) Query

func (Query) Port

func (q Query) Port(port int) Query

func (Query) Protocol

func (q Query) Protocol(proto string) Query

func (Query) Reject

func (q Query) Reject() Query

func (Query) Sort

func (q Query) Sort() Query

func (Query) SourceAddress

func (q Query) SourceAddress(addr string) Query

func (Query) SourcePort

func (q Query) SourcePort(port int) Query