circolog/filtering/filter.go

// +build !nofilter

package filtering

import (
	"fmt"
	"os"

	"github.com/araddon/qlbridge/datasource"
	"github.com/araddon/qlbridge/expr"
	"github.com/araddon/qlbridge/value"
	"github.com/araddon/qlbridge/vm"
)

type ExprValue struct {
	node       expr.Node
	expression string
}

func (e *ExprValue) String() string {
	if e.node != nil {
		return e.node.String()
	} else {
		return "<Empty Expression>"
	}
}
func (e *ExprValue) Set(value string) error {
	if value == "" {
		e.node = nil
		e.expression = value
		return nil
	}
	ast, err := expr.ParseExpression(value)
	if err != nil {
		return err
	}
	e.node = ast
	e.expression = value
	return nil
}

// Validate answers the question whether to include a log line or not.
func (e *ExprValue) Validate(logLine map[string]interface{}) bool {
	if e.node == nil {
		return true
	}
	line := translateMap(logLine)
	context := datasource.NewContextSimpleNative(line)
	val, ok := vm.Eval(context, e.node)
	if !ok || val == nil { // errors when evaluating
		return false
	}
	if bv, isBool := val.(value.BoolValue); isBool {
		return bv.Val()
	}
	fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
	return false
}

func translateMap(lineInput map[string]interface{}) map[string]interface{} {
	lineOutput := make(map[string]interface{})
	lineOutput["prog"] = lineInput["app_name"]
	lineOutput["msg"] = lineInput["message"]
	lineOutput["facility"] = lineInput["facility"]
	lineOutput["host"] = lineInput["hostname"]
	lineOutput["time"] = lineInput["timestamp"]
	lineOutput["sev"] = lineInput["severity"]
	return lineOutput
}