|
@@ -39,10 +39,12 @@ func (e *ExprValue) Set(value string) error {
|
|
return nil
|
|
return nil
|
|
}
|
|
}
|
|
|
|
|
|
-func (e *ExprValue) Validate(line map[string]interface{}) bool {
|
|
|
|
|
|
+// Validate answers the question wether to include a log line or not.
|
|
|
|
+func (e *ExprValue) Validate(lineInput map[string]interface{}) bool {
|
|
if e.node == nil {
|
|
if e.node == nil {
|
|
return true
|
|
return true
|
|
}
|
|
}
|
|
|
|
+ line := translateMap(lineInput)
|
|
context := datasource.NewContextSimpleNative(line)
|
|
context := datasource.NewContextSimpleNative(line)
|
|
val, ok := vm.Eval(context, e.node)
|
|
val, ok := vm.Eval(context, e.node)
|
|
if !ok || val == nil { // errors when evaluating
|
|
if !ok || val == nil { // errors when evaluating
|
|
@@ -54,3 +56,14 @@ func (e *ExprValue) Validate(line map[string]interface{}) bool {
|
|
fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
|
|
fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
|
|
return false
|
|
return false
|
|
}
|
|
}
|
|
|
|
+
|
|
|
|
+func translateMap(lineInput map[string]interface{}) map[string]interface{} {
|
|
|
|
+ lineOutput := make(map[string]interface{})
|
|
|
|
+ lineOutput["prog"] = lineInput["app_name"]
|
|
|
|
+ lineOutput["msg"] = lineInput["message"]
|
|
|
|
+ lineOutput["facility"] = lineInput["facility"]
|
|
|
|
+ lineOutput["host"] = lineInput["hostname"]
|
|
|
|
+ lineOutput["time"] = lineInput["timestamp"]
|
|
|
|
+ lineOutput["sev"] = lineInput["severity"]
|
|
|
|
+ return lineOutput
|
|
|
|
+}
|