From 05f9e0f1d199da8e44f310aef0158b6efe72bdd3 Mon Sep 17 00:00:00 2001
From: Blallo <blallo@autistici.org>
Date: Wed, 9 Jan 2019 16:39:06 +0100
Subject: [PATCH] Translate the keywords for the QL.

---
 filtering/filter.go | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/filtering/filter.go b/filtering/filter.go
index bc3f825..24291cc 100644
--- a/filtering/filter.go
+++ b/filtering/filter.go
@@ -39,10 +39,12 @@ func (e *ExprValue) Set(value string) error {
 	return nil
 }
 
-func (e *ExprValue) Validate(line map[string]interface{}) bool {
+// Validate answers the question wether to include a log line or not.
+func (e *ExprValue) Validate(lineInput map[string]interface{}) bool {
 	if e.node == nil {
 		return true
 	}
+	line := translateMap(lineInput)
 	context := datasource.NewContextSimpleNative(line)
 	val, ok := vm.Eval(context, e.node)
 	if !ok || val == nil { // errors when evaluating
@@ -54,3 +56,14 @@ func (e *ExprValue) Validate(line map[string]interface{}) bool {
 	fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
 	return false
 }
+
+func translateMap(lineInput map[string]interface{}) map[string]interface{} {
+	lineOutput := make(map[string]interface{})
+	lineOutput["prog"] = lineInput["app_name"]
+	lineOutput["msg"] = lineInput["message"]
+	lineOutput["facility"] = lineInput["facility"]
+	lineOutput["host"] = lineInput["hostname"]
+	lineOutput["time"] = lineInput["timestamp"]
+	lineOutput["sev"] = lineInput["severity"]
+	return lineOutput
+}