filtercond

README

gogstash cond filter module

Condition syntax depends govaluate:

• https://github.com/Knetic/govaluate

Only boolean true for the result value is considered to be eligible.

Built-in functions:

• empty() Checks if the argument is nil
• strlen() Returns the string argument's length
• map() Maps slice to []interface{}
• rand() Returns a pseudo-random number in [0.0, 1.0) as a float64

Synopsis

filter:
  - type: cond
    # (required) condition need to be satisfied
    condition: "level == 'ERROR'"
    # (required) filter config
    filter:
      - type: add_field
        key: foo
        value: bar
    # (optional) filter config when condition was not met
    else_filter:
      - type: add_field
        key: foo
        value: bar2

filter:
  - type: cond
    # (required) condition need to be satisfied
    condition: "!('gogstash_filter_grok_error' IN map([tags]))"
    # (required) filter config
    filter:
      - type: remove_field
        remove_message: true

Documentation

Index

• Constants
• Variables
• func InitHandler(ctx context.Context, raw config.ConfigRaw, control config.Control) (config.TypeFilterConfig, error)
• type EventParameters
  • func (ep *EventParameters) Get(field string) (any, error)
• type FilterConfig
  • func DefaultFilterConfig() FilterConfig
  • func (f *FilterConfig) Event(ctx context.Context, event logevent.LogEvent) (logevent.LogEvent, bool)

Constants

const ErrorTag = "gogstash_filter_cond_error"

ErrorTag tag added to event when process geoip2 failed

const ModuleName = "cond"

ModuleName is the name used in config file

Variables

var (
	ErrorBuiltInFunctionParameters1 = errutil.NewFactory("Built-in function '%s' parameters error")
	BuiltInFunctions                = map[string]govaluate.ExpressionFunction{
		"empty": func(args ...any) (any, error) {
			if len(args) > 1 {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "empty")
			} else if len(args) == 0 {
				return true, nil
			}
			return args[0] == nil, nil
		},
		"strlen": func(args ...any) (any, error) {
			if len(args) > 1 {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "strlen")
			} else if len(args) == 0 {
				return float64(0), nil
			}
			length := len(args[0].(string))
			return float64(length), nil
		},
		"map": func(args ...any) (any, error) {
			if len(args) > 1 {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "map")
			} else if len(args) == 0 {
				return []any{}, nil
			}

			s := reflect.ValueOf(args[0])
			if s.Kind() != reflect.Slice {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "map")
			}

			ret := make([]any, s.Len())

			for i := 0; i < s.Len(); i++ {
				ret[i] = s.Index(i).Interface()
			}

			return ret, nil
		},
		"rand": func(args ...any) (any, error) {
			if len(args) > 0 {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "rand")
			}
			return rand.Float64(), nil
		},
	}
)

built-in functions

Functions

func InitHandler

func InitHandler(
	ctx context.Context,
	raw config.ConfigRaw,
	control config.Control,
) (config.TypeFilterConfig, error)

InitHandler initialize the filter plugin

Types

type EventParameters

type EventParameters struct {
	Event *logevent.LogEvent
}

EventParameters pack event's parameters by member function `Get` access

func (*EventParameters) Get

func (ep *EventParameters) Get(field string) (any, error)

Get obtaining value from event's specified field recursively

type FilterConfig

type FilterConfig struct {
	config.FilterConfig

	Condition     string             `json:"condition"`   // condition need to be satisfied
	FilterRaw     []config.ConfigRaw `json:"filter"`      // filters when satisfy the condition
	ElseFilterRaw []config.ConfigRaw `json:"else_filter"` // filters when does not met the condition
	// contains filtered or unexported fields
}

FilterConfig holds the configuration json fields and internal objects

func DefaultFilterConfig

func DefaultFilterConfig() FilterConfig

DefaultFilterConfig returns an FilterConfig struct with default values

func (*FilterConfig) Event

func (f *FilterConfig) Event(
	ctx context.Context,
	event logevent.LogEvent,
) (logevent.LogEvent, bool)

Event the main filter event