forked from boyska/circolog
Translate the keywords for the QL.
This commit is contained in:
parent
c1ae059712
commit
9b6454bf1b
2 changed files with 19 additions and 6 deletions
|
@ -11,11 +11,11 @@ Reference
|
||||||
-----------
|
-----------
|
||||||
|
|
||||||
Available fields:
|
Available fields:
|
||||||
- `message`: the string with the main information
|
- `msg`: the string with the main information
|
||||||
- `app_name`: also known as "program" sometimes
|
- `prog`: also known as "program" sometimes
|
||||||
- `facility`: an integer describing auth, daemon, user, etc.
|
- `facility`: an integer describing auth, daemon, user, etc.
|
||||||
- `hostname`: the hostname where the entry originated
|
- `host`: the hostname where the entry originated
|
||||||
- `timestamp`: date in format `2019-01-07T15:28:58+01:00`
|
- `time`: date in format `2019-01-07T15:28:58+01:00`
|
||||||
- `severity`: an integer describing severity
|
- `sev`: an integer describing severity
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -39,10 +39,12 @@ func (e *ExprValue) Set(value string) error {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func (e *ExprValue) Validate(line map[string]interface{}) bool {
|
// Validate answers the question wether to include a log line or not.
|
||||||
|
func (e *ExprValue) Validate(lineInput map[string]interface{}) bool {
|
||||||
if e.node == nil {
|
if e.node == nil {
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
line := translateMap(lineInput)
|
||||||
context := datasource.NewContextSimpleNative(line)
|
context := datasource.NewContextSimpleNative(line)
|
||||||
val, ok := vm.Eval(context, e.node)
|
val, ok := vm.Eval(context, e.node)
|
||||||
if !ok || val == nil { // errors when evaluating
|
if !ok || val == nil { // errors when evaluating
|
||||||
|
@ -54,3 +56,14 @@ func (e *ExprValue) Validate(line map[string]interface{}) bool {
|
||||||
fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
|
fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func translateMap(lineInput map[string]interface{}) map[string]interface{} {
|
||||||
|
lineOutput := make(map[string]interface{})
|
||||||
|
lineOutput["prog"] = lineInput["app_name"]
|
||||||
|
lineOutput["msg"] = lineInput["message"]
|
||||||
|
lineOutput["facility"] = lineInput["facility"]
|
||||||
|
lineOutput["host"] = lineInput["hostname"]
|
||||||
|
lineOutput["time"] = lineInput["timestamp"]
|
||||||
|
lineOutput["sev"] = lineInput["severity"]
|
||||||
|
return lineOutput
|
||||||
|
}
|
||||||
|
|
Loading…
Reference in a new issue