input

package
v1.3.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 18, 2021 License: MIT Imports: 17 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	PRI_PART_START = '<'
	PRI_PART_END   = '>'
	NO_VERSION     = -1
)
View Source 
const (
	NILVALUE = '-'
)
View Source 
const (
	// SYSLOG_DELIMITER indicates the start of a syslog line
	SYSLOG_DELIMITER = `<[0-9]{1,3}>[0-9]\s`
)

Variables

View Source 
var (
	ErrEOL                    = &ParserError{"End of log line"}
	ErrNoSpace                = &ParserError{"No space found"}
	ErrPriorityNoStart        = &ParserError{"No start char found for priority"}
	ErrPriorityEmpty          = &ParserError{"Priority field empty"}
	ErrPriorityNoEnd          = &ParserError{"No end char found for priority"}
	ErrPriorityTooShort       = &ParserError{"Priority field too short"}
	ErrPriorityTooLong        = &ParserError{"Priority field too long"}
	ErrPriorityNonDigit       = &ParserError{"Non digit found in priority"}
	ErrVersionNotFound        = &ParserError{"Can not find version"}
	ErrTimestampUnknownFormat = &ParserError{"Timestamp format unknown"}
)
View Source 
var (
	ErrYearInvalid       = &ParserError{"Invalid year in timestamp"}
	ErrMonthInvalid      = &ParserError{"Invalid month in timestamp"}
	ErrDayInvalid        = &ParserError{"Invalid day in timestamp"}
	ErrHourInvalid       = &ParserError{"Invalid hour in timestamp"}
	ErrMinuteInvalid     = &ParserError{"Invalid minute in timestamp"}
	ErrSecondInvalid     = &ParserError{"Invalid second in timestamp"}
	ErrSecFracInvalid    = &ParserError{"Invalid fraction of second in timestamp"}
	ErrTimeZoneInvalid   = &ParserError{"Invalid time zone in timestamp"}
	ErrInvalidTimeFormat = &ParserError{"Invalid time format"}
	ErrInvalidAppName    = &ParserError{"Invalid app name"}
	ErrInvalidProcId     = &ParserError{"Invalid proc ID"}
	ErrInvalidMsgId      = &ParserError{"Invalid msg ID"}
	ErrNoStructuredData  = &ParserError{"No structured data"}
)

Functions

func IsDigit added in v1.3.1 

func IsDigit(c byte) bool

func Parse2Digits added in v1.3.1 

func Parse2Digits(bs []byte, min int, max int, e error) ([]byte, int, error)

func ParseHostname added in v1.3.1 

func ParseHostname(bs []byte) ([]byte, string)

func ParseTag added in v1.3.1 

func ParseTag(bs []byte) ([]byte, string)

http://tools.ietf.org/html/rfc3164#section-4.1.3

func ParseTimestamp added in v1.3.1 

func ParseTimestamp(bs []byte) ([]byte, time.Time, error)

ParseTimestamp https://tools.ietf.org/html/rfc3164#section-4.1.2

func ParseVersion added in v1.3.1 

func ParseVersion(bs []byte) ([]byte, int, error)

https://tools.ietf.org/html/rfc5424#section-6.2.2

func ShowCursorPos added in v1.3.1 

func ShowCursorPos(buff []byte, cursor int)

func ValidFormat added in v1.1.0 

func ValidFormat(format string) bool

ValidFormat returns if the given format matches one of the possible formats.

Types

type Collector 

type Collector interface {
	Start(chan<- ekanite.Document) error
	Addr() net.Addr
}

Collector specifies the interface all network collectors must implement.

func NewCollector 

func NewCollector(proto, iface, format string, tlsConfig *tls.Config) (Collector, error)

NewCollector returns a network collector of the specified type, that will bind to the given inteface on Start(). If config is non-nil, a secure Collector will be returned. Secure Collectors require the protocol be TCP.

type Event 

type Event struct {
	Text          string                 // Delimited log line
	Parsed        map[string]interface{} // If non-nil, contains parsed fields
	ReceptionTime time.Time              // Time log line was received
	Sequence      int64                  // Provides order of reception
	SourceIP      string                 // Sender's IP address
	// contains filtered or unexported fields
}

Event is a log message, with a reception timestamp and sequence number.

func (*Event) Data added in v1.3.1 

func (e *Event) Data() interface{}

Data returns the indexable data.

func (*Event) ID added in v1.3.1 

func (e *Event) ID() ekanite.DocID

ID returns a unique ID for the event.

func (*Event) ReferenceTime 

func (e *Event) ReferenceTime() time.Time

ReferenceTime returns the reference time of an event.

type Facility added in v1.3.1 

type Facility struct {
	Value int
}

type LogParser added in v1.3.1 

type LogParser struct {
	Raw    []byte
	Result map[string]interface{}
	// contains filtered or unexported fields
}

A Parser parses the raw input as a map with a timestamp field.

func NewLogParser added in v1.3.1 

func NewLogParser(f string) (*LogParser, error)

NewParser returns a new Parser instance.

func (*LogParser) Parse added in v1.3.1 

func (p *LogParser) Parse(address string, b []byte)

Parse the given byte slice.

type NetstrDelimiter added in v1.1.0 

type NetstrDelimiter struct {
	Result string
	// contains filtered or unexported fields
}

A NetstrDelimiter detects when message lines start.

func NewNetstrDelimiter added in v1.1.0 

func NewNetstrDelimiter() *NetstrDelimiter

NewNetstrDelimiter returns an initialized NetstrDelimiter.

func (*NetstrDelimiter) Push added in v1.1.0 

func (d *NetstrDelimiter) Push(b byte) (bool, error)

Push the given byte into a buffer, return when a new result is available, as well as the first occurring error (if any occurred).

func (*NetstrDelimiter) Reset added in v1.1.0 

func (d *NetstrDelimiter) Reset()

Reset the NetstrDelimiter instance to its initial state.

type Parser added in v1.1.0 

type Parser interface {
	Parse(bs []byte) (map[string]interface{}, error)
}

func CreateParser added in v1.3.1 

func CreateParser(format string) Parser

type ParserError added in v1.3.1 

type ParserError struct {
	ErrorString string
}

func (*ParserError) Error added in v1.3.1 

func (err *ParserError) Error() string

type Priority added in v1.3.1 

type Priority struct {
	P int
	F Facility
	S Severity
}

func ParsePriority added in v1.3.1 

func ParsePriority(bs []byte) ([]byte, Priority, error)

https://tools.ietf.org/html/rfc3164#section-4.1

type RFC5424V2 added in v1.3.1 

type RFC5424V2 struct {
	// contains filtered or unexported fields
}

RFC5424V2 represents a parser for RFC5424V2-compliant log messages

type Severity added in v1.3.1 

type Severity struct {
	Value int
}

type SyslogDelimiter added in v1.1.0 

type SyslogDelimiter struct {
	// contains filtered or unexported fields
}

A SyslogDelimiter detects when Syslog lines start.

func NewSyslogDelimiter added in v1.1.0 

func NewSyslogDelimiter(maxSize int) *SyslogDelimiter

NewSyslogDelimiter returns an initialized SyslogDelimiter.

func (*SyslogDelimiter) Push added in v1.1.0 

func (s *SyslogDelimiter) Push(b byte) (string, bool)

Push a byte into the SyslogDelimiter. If the byte results in a a new Syslog message, it'll be flagged via the bool.

func (*SyslogDelimiter) Vestige added in v1.1.0 

func (s *SyslogDelimiter) Vestige() (string, bool)

Vestige returns the bytes which have been pushed to SyslogDelimiter, since the last Syslog message was returned, but only if the buffer appears to be a valid syslog message.

type TCPCollector 

type TCPCollector struct {
	// contains filtered or unexported fields
}

TCPCollector represents a network collector that accepts and handler TCP connections.

func (*TCPCollector) Addr 

func (s *TCPCollector) Addr() net.Addr

Addr returns the net.Addr that the Collector is bound to, in a race-say manner.

func (*TCPCollector) Start 

func (s *TCPCollector) Start(c chan<- ekanite.Document) error

Start instructs the TCPCollector to bind to the interface and accept connections.

type UDPCollector 

type UDPCollector struct {
	// contains filtered or unexported fields
}

UDPCollector represents a network collector that accepts UDP packets.

func (*UDPCollector) Addr 

func (s *UDPCollector) Addr() net.Addr

Addr returns the net.Addr to which the UDP collector is bound.

func (*UDPCollector) Start 

func (s *UDPCollector) Start(c chan<- ekanite.Document) error

Start instructs the UDPCollector to start reading packets from the interface.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.