Documentation ¶
Index ¶
- Constants
- Variables
- func AddTags(ms MapStr, tags []string) error
- func BytesHtohl(b []byte) uint32
- func BytesNtohl(b []byte) uint32
- func BytesNtohll(b []byte) uint64
- func BytesNtohs(b []byte) uint16
- func DumpInCSVFormat(fields []string, rows [][]string) string
- func EncodeURLParams(url string, params url.Values) string
- func IPv4Ntoa(ip uint32) string
- func IsLoopback(ipStr string) (bool, error)
- func IsStrictPerms() bool
- func LoadGeoIPData(config Geoip) *libgeo.GeoIP
- func LocalIPAddrs() ([]net.IP, error)
- func LocalIPAddrsAsStrings(includeLoopbacks bool) ([]string, error)
- func MakeURL(defaultScheme string, defaultPath string, rawURL string, defaultPort int) (string, error)
- func MergeFields(ms, fields MapStr, underRoot bool) error
- func NewFlagOverwrite(set *flag.FlagSet, config *Config, name, path, def, usage string) *string
- func ReadString(s []byte) (string, error)
- type Backoff
- type Cache
- func (c *Cache) CleanUp() int
- func (c *Cache) Delete(k Key) Value
- func (c *Cache) Entries() map[Key]Value
- func (c *Cache) Get(k Key) Value
- func (c *Cache) Put(k Key, v Value) Value
- func (c *Cache) PutIfAbsent(k Key, v Value) Value
- func (c *Cache) PutIfAbsentWithTimeout(k Key, v Value, timeout time.Duration) Value
- func (c *Cache) PutWithTimeout(k Key, v Value, timeout time.Duration) Value
- func (c *Cache) Replace(k Key, v Value) Value
- func (c *Cache) ReplaceWithTimeout(k Key, v Value, timeout time.Duration) Value
- func (c *Cache) Size() int
- func (c *Cache) StartJanitor(interval time.Duration)
- func (c *Cache) StopJanitor()
- type CmdlineTuple
- type Config
- func LoadFile(path string) (*Config, error)
- func LoadFiles(paths ...string) (*Config, error)
- func MergeConfigs(cfgs ...*Config) (*Config, error)
- func NewConfig() *Config
- func NewConfigFrom(from interface{}) (*Config, error)
- func NewConfigWithYAML(in []byte, source string) (*Config, error)
- func NewFlagConfig(set *flag.FlagSet, def *Config, name string, usage string) *Config
- func (c *Config) Bool(name string, idx int) (bool, error)
- func (c *Config) Child(name string, idx int) (*Config, error)
- func (c *Config) CountField(name string) (int, error)
- func (c *Config) Enabled() bool
- func (c *Config) Float(name string, idx int) (float64, error)
- func (c *Config) GetFields() []string
- func (c *Config) HasField(name string) bool
- func (c *Config) Int(name string, idx int) (int64, error)
- func (c *Config) IsArray() bool
- func (c *Config) IsDict() bool
- func (c *Config) Merge(from interface{}) error
- func (c *Config) Path() string
- func (c *Config) PathOf(field string) string
- func (c *Config) PrintDebugf(msg string, params ...interface{})
- func (c *Config) SetBool(name string, idx int, value bool) error
- func (c *Config) SetChild(name string, idx int, value *Config) error
- func (c *Config) SetFloat(name string, idx int, value float64) error
- func (c *Config) SetInt(name string, idx int, value int64) error
- func (c *Config) SetString(name string, idx int, value string) error
- func (c *Config) String(name string, idx int) (string, error)
- func (c *Config) Unpack(to interface{}) error
- type ConfigNamespace
- type Endpoint
- type EventMetadata
- type Float
- type Geoip
- type HashableIPPortTuple
- type HashableTCPTuple
- type IPPortTuple
- type Key
- type MapStr
- func (m MapStr) Clone() MapStr
- func (m MapStr) CopyFieldsTo(to MapStr, key string) error
- func (m MapStr) Delete(key string) error
- func (m MapStr) GetValue(key string) (interface{}, error)
- func (m MapStr) HasKey(key string) (bool, error)
- func (m MapStr) Put(key string, value interface{}) (interface{}, error)
- func (m MapStr) String() string
- func (m MapStr) StringToPrint() string
- func (m MapStr) Update(d MapStr)
- type NetString
- type RemovalListener
- type StringSet
- type TCPTuple
- type Time
- type Value
- type Version
Constants ¶
const ( EventMetadataKey = "_event_metadata" FieldsKey = "fields" TagsKey = "tags" )
Event metadata constants. These keys are used within libbeat to identify metadata stored in an event.
const ( OK_STATUS = "OK" ERROR_STATUS = "Error" SERVER_ERROR_STATUS = "Server Error" CLIENT_ERROR_STATUS = "Client Error" )
standardized status values
const MaxIPPortTupleRawSize = 16 + 16 + 2 + 2
const MaxTCPTupleRawSize = 16 + 16 + 2 + 2 + 4
const TsLayout = "2006-01-02T15:04:05.000Z"
TsLayout is the layout to be used in the timestamp marshaling/unmarshaling everywhere. The timezone must always be UTC.
Variables ¶
var ( // ErrKeyNotFound indicates that the specified key was not found. ErrKeyNotFound = errors.New("key not found") )
Functions ¶
func AddTags ¶
AddTags appends a tag to the tags field of ms. If the tags field does not exist then it will be created. If the tags field exists and is not a []string then an error will be returned. It does not deduplicate the list of tags.
func BytesHtohl ¶
func BytesNtohl ¶
func BytesNtohll ¶
func BytesNtohs ¶
func DumpInCSVFormat ¶
DumpInCSVFormat takes a set of fields and rows and returns a string representing the CSV representation for the fields and rows.
func IsLoopback ¶
IsLoopback check if a particular IP notation corresponds to a loopback interface.
func IsStrictPerms ¶ added in v5.3.0
func IsStrictPerms() bool
IsStrictPerms returns true if strict permission checking on config files is enabled.
func LoadGeoIPData ¶
func LoadGeoIPData(config Geoip) *libgeo.GeoIP
func LocalIPAddrs ¶
LocalIPAddrs finds the IP addresses of the hosts on which the shipper currently runs on.
func LocalIPAddrsAsStrings ¶
LocalIPAddrsAsStrings finds the IP addresses of the hosts on which the shipper currently runs on and returns them as an array of strings.
func MakeURL ¶ added in v5.5.3
func MakeURL(defaultScheme string, defaultPath string, rawURL string, defaultPort int) (string, error)
MakeURL creates the url based on the url configuration. Adds missing parts with defaults (scheme, host, port)
func MergeFields ¶
MergeFields merges the top-level keys and values in each source map (it does not perform a deep merge). If the same key exists in both, the value in fields takes precedence. If underRoot is true then the contents of the fields MapStr is merged with the value of the 'fields' key in ms.
An error is returned if underRoot is true and the value of ms.fields is not a MapStr.
func NewFlagOverwrite ¶
func ReadString ¶
ReadString extracts the first null terminated string from a slice of bytes.
Types ¶
type Backoff ¶
type Backoff struct {
// contains filtered or unexported fields
}
A Backoff waits on errors with exponential backoff (limited by maximum backoff). Resetting Backoff will reset the next sleep timer to the initial backoff duration.
func NewBackoff ¶
func (*Backoff) WaitOnError ¶
type Cache ¶
Cache is a semi-persistent mapping of keys to values. Elements added to the cache are store until they are explicitly deleted or are expired due time- based eviction based on last access time.
Expired elements are not visible through classes methods, but they do remain stored in the cache until CleanUp() is invoked. Therefore CleanUp() must be invoked periodically to prevent the cache from becoming a memory leak. If you want to start a goroutine to perform periodic clean-up then see StartJanitor().
Cache does not support storing nil values. Any attempt to put nil into the cache will cause a panic.
func NewCache ¶
NewCache creates and returns a new Cache. d is the length of time after last access that cache elements expire. initialSize is the initial allocation size used for the Cache's underlying map.
func NewCacheWithRemovalListener ¶
func NewCacheWithRemovalListener(d time.Duration, initialSize int, l RemovalListener) *Cache
NewCacheWithRemovalListener creates and returns a new Cache and register a RemovalListener callback function. d is the length of time after last access that cache elements expire. initialSize is the initial allocation size used for the Cache's underlying map. l is the callback function that will be invoked when cache elements are removed from the map on CleanUp.
func (*Cache) CleanUp ¶
CleanUp performs maintenance on the cache by removing expired elements from the cache. If a RemoveListener is registered it will be invoked for each element that is removed during this clean up operation. The RemovalListener is invoked on the caller's goroutine.
func (*Cache) Delete ¶
Delete a key from the map and return the value or nil if the key does not exist. The RemovalListener is not notified for explicit deletions.
func (*Cache) Get ¶
Get the current value associated with a key or nil if the key is not present. The last access time of the element is updated.
func (*Cache) Put ¶
Put writes the given key and value to the map replacing any existing value if it exists. The previous value associated with the key returned or nil if the key was not present.
func (*Cache) PutIfAbsent ¶
PutIfAbsent writes the given key and value to the cache only if the key is absent from the cache. Nil is returned if the key-value pair were written, otherwise the old value is returned.
func (*Cache) PutIfAbsentWithTimeout ¶
PutIfAbsentWithTimeout writes the given key and value to the cache only if the key is absent from the cache. Nil is returned if the key-value pair were written, otherwise the old value is returned. The cache expiration time will be overwritten by timeout of the key being inserted.
func (*Cache) PutWithTimeout ¶
PutWithTimeout writes the given key and value to the map replacing any existing value if it exists. The previous value associated with the key returned or nil if the key was not present. The cache expiration time will be overwritten by timeout of the key being inserted.
func (*Cache) Replace ¶
Replace overwrites the value for a key only if the key exists. The old value is returned if the value is updated, otherwise nil is returned.
func (*Cache) ReplaceWithTimeout ¶
ReplaceWithTimeout overwrites the value for a key only if the key exists. The old value is returned if the value is updated, otherwise nil is returned. The cache expiration time will be overwritten by timeout of the key being inserted.
func (*Cache) Size ¶
Size returns the number of elements in the cache. The number includes both active elements and expired elements that have not been cleaned up.
func (*Cache) StartJanitor ¶
StartJanitor starts a goroutine that will periodically invoke the cache's CleanUp() method.
func (*Cache) StopJanitor ¶
func (c *Cache) StopJanitor()
StopJanitor stops the goroutine created by StartJanitor.
type CmdlineTuple ¶
type CmdlineTuple struct {
Src, Dst []byte
}
Source and destination process names, as found by the proc module.
type Config ¶
type Config ucfg.Config
Config object to store hierarchical configurations into. See https://godoc.org/github.com/elastic/go-ucfg#Config
func MergeConfigs ¶
func NewConfigFrom ¶
func NewFlagConfig ¶
func (*Config) PrintDebugf ¶ added in v5.3.0
type ConfigNamespace ¶ added in v5.3.0
ConfigNamespace storing at most one configuration section by name and sub-section.
func (*ConfigNamespace) Config ¶ added in v5.3.0
func (ns *ConfigNamespace) Config() *Config
Config return the sub-configuration section if a section has been set.
func (*ConfigNamespace) IsSet ¶ added in v5.3.0
func (ns *ConfigNamespace) IsSet() bool
IsSet returns true if a sub-configuration section has been set.
func (*ConfigNamespace) Name ¶ added in v5.3.0
func (ns *ConfigNamespace) Name() string
Name returns the configuration sections it's name if a section has been set.
func (*ConfigNamespace) Validate ¶ added in v5.3.0
func (ns *ConfigNamespace) Validate() error
Validate checks at most one sub-namespace being set.
type EventMetadata ¶
type EventMetadata struct { Fields MapStr FieldsUnderRoot bool `config:"fields_under_root"` Tags []string }
EventMetadata contains fields and tags that can be added to an event via configuration.
type HashableIPPortTuple ¶
type HashableIPPortTuple [MaxIPPortTupleRawSize]byte
type HashableTCPTuple ¶
type HashableTCPTuple [MaxTCPTupleRawSize]byte
type IPPortTuple ¶
type IPPortTuple struct { IPLength int SrcIP, DstIP net.IP SrcPort, DstPort uint16 // contains filtered or unexported fields }
func NewIPPortTuple ¶
func (*IPPortTuple) ComputeHashebles ¶
func (t *IPPortTuple) ComputeHashebles()
func (*IPPortTuple) Hashable ¶
func (t *IPPortTuple) Hashable() HashableIPPortTuple
Hashable returns a hashable value that uniquely identifies the IP-port tuple.
func (*IPPortTuple) RevHashable ¶
func (t *IPPortTuple) RevHashable() HashableIPPortTuple
Hashable returns a hashable value that uniquely identifies the IP-port tuple after swapping the source and destination.
func (*IPPortTuple) String ¶
func (t *IPPortTuple) String() string
type MapStr ¶
type MapStr map[string]interface{}
MapStr is a map[string]interface{} wrapper with utility methods for common map operations like converting to JSON.
func ConvertToGenericEvent ¶
ConvertToGenericEvent normalizes the types contained in the given MapStr.
Nil values in maps are dropped during the conversion. Any unsupported types that are found in the MapStr are dropped and warnings are logged.
func MapStrUnion ¶
MapStrUnion creates a new MapStr containing the union of the key-value pairs of the two maps. If the same key is present in both, the key-value pairs from dict2 overwrite the ones from dict1.
func (MapStr) Clone ¶
Clone returns a copy of the MapStr. It recursively makes copies of inner maps.
func (MapStr) CopyFieldsTo ¶
CopyFieldsTo copies the field specified by key to the given map. It will overwrite the key if it exists. An error is returned if the key does not exist in the source map.
func (MapStr) GetValue ¶
GetValue gets a value from the map. If the key does not exist then an error is returned.
func (MapStr) HasKey ¶
HasKey returns true if the key exist. If an error occurs then false is returned with a non-nil error.
func (MapStr) Put ¶
Put associates the specified value with the specified key. If the map previously contained a mapping for the key, the old value is replaced and returned. The key can be expressed in dot-notation (e.g. x.y) to put a value into a nested map.
If you need insert keys containing dots then you must use bracket notation to insert values (e.g. m[key] = value).
func (MapStr) StringToPrint ¶
StringToPrint returns the MapStr as pretty JSON.
type NetString ¶
type NetString []byte
NetString store the byte length of the data that follows, making it easier to unambiguously pass text and byte data between programs that could be sensitive to values that could be interpreted as delimiters or terminators (such as a null character).
func (NetString) MarshalText ¶
MarshalText exists to implement encoding.TextMarshaller interface to treat []byte as raw string by other encoders/serializers (e.g. JSON)
type RemovalListener ¶
RemovalListener is the callback function type that can be registered with the cache to receive notification of the removal of expired elements.
type StringSet ¶ added in v5.3.0
type StringSet map[string]struct{}
func MakeStringSet ¶ added in v5.3.0
type TCPTuple ¶
type TCPTuple struct { IPLength int SrcIP, DstIP net.IP SrcPort, DstPort uint16 StreamID uint32 // contains filtered or unexported fields }
func TCPTupleFromIPPort ¶
func TCPTupleFromIPPort(t *IPPortTuple, streamID uint32) TCPTuple
func (*TCPTuple) ComputeHashebles ¶
func (t *TCPTuple) ComputeHashebles()
func (*TCPTuple) Hashable ¶
func (t *TCPTuple) Hashable() HashableTCPTuple
Hashable() returns a hashable value that uniquely identifies the TCP tuple.
func (TCPTuple) IPPort ¶
func (t TCPTuple) IPPort() *IPPortTuple
Returns a pointer to the equivalent IpPortTuple.
type Time ¶
Time is an abstraction for the time.Time type
func MustParseTime ¶
MustParseTime is a convenience equivalent of the ParseTime function that panics in case of errors.
func (Time) MarshalJSON ¶
MarshalJSON implements json.Marshaler interface. The time is a quoted string in the JsTsLayout format.
func (*Time) UnmarshalJSON ¶
UnmarshalJSON implements js.Unmarshaler interface. The time is expected to be a quoted string in TsLayout format.
type Version ¶ added in v5.5.3
type Version struct { Major int Minor int Bugfix int Meta string // contains filtered or unexported fields }
func NewVersion ¶ added in v5.5.3
NewVersion expects a string in the format: major.minor.bugfix(-meta)
Source Files ¶
Directories ¶
Path | Synopsis |
---|---|
Package dtfmt provides time formatter support with pattern syntax mostly similar to joda DateTimeFormat.
|
Package dtfmt provides time formatter support with pattern syntax mostly similar to joda DateTimeFormat. |
Package streambuf provides helpers for buffering multiple packet payloads and some general parsing functions.
|
Package streambuf provides helpers for buffering multiple packet payloads and some general parsing functions. |