123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869 |
- // +build !nofilter
- package filtering
- import (
- "fmt"
- "os"
- "github.com/araddon/qlbridge/datasource"
- "github.com/araddon/qlbridge/expr"
- "github.com/araddon/qlbridge/value"
- "github.com/araddon/qlbridge/vm"
- )
- type ExprValue struct {
- node expr.Node
- expression string
- }
- func (e *ExprValue) String() string {
- if e.node != nil {
- return e.node.String()
- } else {
- return "<Empty Expression>"
- }
- }
- func (e *ExprValue) Set(value string) error {
- if value == "" {
- e.node = nil
- e.expression = value
- return nil
- }
- ast, err := expr.ParseExpression(value)
- if err != nil {
- return err
- }
- e.node = ast
- e.expression = value
- return nil
- }
- // Validate answers the question wether to include a log line or not.
- func (e *ExprValue) Validate(lineInput map[string]interface{}) bool {
- if e.node == nil {
- return true
- }
- line := translateMap(lineInput)
- context := datasource.NewContextSimpleNative(line)
- val, ok := vm.Eval(context, e.node)
- if !ok || val == nil { // errors when evaluating
- return false
- }
- if bv, isBool := val.(value.BoolValue); isBool {
- return bv.Val()
- }
- fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
- return false
- }
- func translateMap(lineInput map[string]interface{}) map[string]interface{} {
- lineOutput := make(map[string]interface{})
- lineOutput["prog"] = lineInput["app_name"]
- lineOutput["msg"] = lineInput["message"]
- lineOutput["facility"] = lineInput["facility"]
- lineOutput["host"] = lineInput["hostname"]
- lineOutput["time"] = lineInput["timestamp"]
- lineOutput["sev"] = lineInput["severity"]
- return lineOutput
- }
|