// +build !nofilter package filtering import ( "fmt" "os" "github.com/araddon/qlbridge/datasource" "github.com/araddon/qlbridge/expr" "github.com/araddon/qlbridge/value" "github.com/araddon/qlbridge/vm" ) type ExprValue struct { node expr.Node expression string } func (e *ExprValue) String() string { if e.node != nil { return e.node.String() } else { return "" } } func (e *ExprValue) Set(value string) error { if value == "" { e.node = nil e.expression = value return nil } ast, err := expr.ParseExpression(value) if err != nil { return err } e.node = ast e.expression = value return nil } // Validate answers the question whether to include a log line or not. func (e *ExprValue) Validate(logLine map[string]interface{}) bool { if e.node == nil { return true } line := translateMap(logLine) context := datasource.NewContextSimpleNative(line) val, ok := vm.Eval(context, e.node) if !ok || val == nil { // errors when evaluating return false } if bv, isBool := val.(value.BoolValue); isBool { return bv.Val() } fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean") return false } func translateMap(lineInput map[string]interface{}) map[string]interface{} { lineOutput := make(map[string]interface{}) lineOutput["prog"] = lineInput["app_name"] lineOutput["msg"] = lineInput["message"] lineOutput["facility"] = lineInput["facility"] lineOutput["host"] = lineInput["hostname"] lineOutput["time"] = lineInput["timestamp"] lineOutput["sev"] = lineInput["severity"] return lineOutput }