69 lines
1.6 KiB
Go
69 lines
1.6 KiB
Go
// +build !nofilter
|
|
|
|
package filtering
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/araddon/qlbridge/datasource"
|
|
"github.com/araddon/qlbridge/expr"
|
|
"github.com/araddon/qlbridge/value"
|
|
"github.com/araddon/qlbridge/vm"
|
|
)
|
|
|
|
type ExprValue struct {
|
|
node expr.Node
|
|
expression string
|
|
}
|
|
|
|
func (e *ExprValue) String() string {
|
|
if e.node != nil {
|
|
return e.node.String()
|
|
} else {
|
|
return "<Empty Expression>"
|
|
}
|
|
}
|
|
func (e *ExprValue) Set(value string) error {
|
|
if value == "" {
|
|
e.node = nil
|
|
e.expression = value
|
|
return nil
|
|
}
|
|
ast, err := expr.ParseExpression(value)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
e.node = ast
|
|
e.expression = value
|
|
return nil
|
|
}
|
|
|
|
// Validate answers the question whether to include a log line or not.
|
|
func (e *ExprValue) Validate(logLine map[string]interface{}) bool {
|
|
if e.node == nil {
|
|
return true
|
|
}
|
|
line := translateMap(logLine)
|
|
context := datasource.NewContextSimpleNative(line)
|
|
val, ok := vm.Eval(context, e.node)
|
|
if !ok || val == nil { // errors when evaluating
|
|
return false
|
|
}
|
|
if bv, isBool := val.(value.BoolValue); isBool {
|
|
return bv.Val()
|
|
}
|
|
fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
|
|
return false
|
|
}
|
|
|
|
func translateMap(lineInput map[string]interface{}) map[string]interface{} {
|
|
lineOutput := make(map[string]interface{})
|
|
lineOutput["prog"] = lineInput["app_name"]
|
|
lineOutput["msg"] = lineInput["message"]
|
|
lineOutput["facility"] = lineInput["facility"]
|
|
lineOutput["host"] = lineInput["hostname"]
|
|
lineOutput["time"] = lineInput["timestamp"]
|
|
lineOutput["sev"] = lineInput["severity"]
|
|
return lineOutput
|
|
}
|