filter

type Clause struct {
	// contains filtered or unexported fields
}

type ClauseFilter struct {
	// contains filtered or unexported fields
}

type ClauseFilterConfig struct {
	Clause string `help:"Boolean formula describing which events to let through. If empty, let everything through."`
}

type ClearFields struct {
	// contains filtered or unexported fields
}

type ClearFieldsConfig struct {
	Fields []string `help:"set of fields to clear" required:"true"`
}

type Concatenate struct {
	// contains filtered or unexported fields
}

type ConcatenateConfig struct {
	Fields    []string `help:"The field names to concatenate, in order"`
	Target    string   `help:"The field name to save the concatenated value to"`
	Separator string   `help:"Separator to concatenate the values. Must either be empty or a single ASCII, non-nil char"`
}

type Dedup struct {
	// contains filtered or unexported fields
}

type DedupConfig struct {
	Fields       []string `help:"fields to consider when comparing records" required:"true"`
	KeySeparator string   `help:"character separator used to build a key from the fields" default:"\\x1e"`
}

type ExpandJSON struct {
	// contains filtered or unexported fields
}

type ExpandJSONConfig struct {
	Source          string            `help:"record field that contains the json" required:"true"`
	Fields          map[string]string `help:"<JMESPath -> record field> map, the rest will be ignored" required:"true"`
	TrueFalseValues []string          `help:"bind the json boolean values to correstponding strings" default:"[\"true\", \"false\"]"`
}

type ExpandList struct {
	// contains filtered or unexported fields
}

type ExpandListConfig struct {
	Source    string            `help:"record field that contains the list" required:"true"`
	Fields    map[string]string `help:"<list index -> record field> map, the rest will be ignored" required:"true"`
	Separator string            `help:"character separator of the list" default:";"`
}

type FormatTime struct {
	// contains filtered or unexported fields
}

type FormatTimeConfig struct {
	SrcField  string `help:"Field name of the input time" required:"true"`
	DstField  string `help:"Field name of the output time" required:"true"`
	SrcFormat string `help:"Format of the input time" required:"false" default:"UnixDate"`
	DstFormat string `help:"Format of the output time" required:"false" default:"unixms"`
}

type Hash struct {
	// contains filtered or unexported fields
}

type HashConfig struct {
	SrcField string `help:"Name of the field to hash" required:"true"`
	DstField string `help:"Name of the field to write the result to" required:"true"`
	Function string `help:"Name of the hash function to use" required:"true"`
	Encoding string `help:"Name of the encoding function to use" required:"false"`
}

type MetadataLastModified struct {
	// contains filtered or unexported fields
}

type MetadataLastModifiedConfig struct {
	DstField string `help:"Name of the field into which write the timestamp to" required:"true"`
}

type MetadataUrl struct {
	metadata.Cache // type: map[*url.URL]string
	// contains filtered or unexported fields
}

type MetadataUrlConfig struct {
	DstField string `help:"Name of the field into to write the url to (or to clear if there's no url)" required:"true"`
}

type NotNull struct {
	// contains filtered or unexported fields
}

type NotNullConfig struct {
	Fields []string `help:"Fields is the list of fields to check for null/empty values" required:"true"`
}

type PartialClone struct {
	// contains filtered or unexported fields
}

type PartialCloneConfig struct {
	Fields []string `help:"Fields that must be copied to the new line" required:"true"`
}

type RegexMatch struct {
	// contains filtered or unexported fields
}

type RegexMatchConfig struct {
	Fields []string `help:"list of fields to match with the corresponding regular expression in Regexs" default:"[]"`
	Regexs []string `help:"list of regular expression to match. Fields[0] must match Regexs[0], Fields[1] Regexs[1] and so on" default:"[]"`
}

type ReplaceFields struct {
	// contains filtered or unexported fields
}

type ReplaceFieldsConfig struct {
	CopyFields    []string `help:"List of src, dst field pairs, for example [\"srcField1\", \"dstField1\", \"srcField2\", \"dstField2\"]"`
	ReplaceFields []string `help:"List of field, value pairs, for example: [\"Foo\", \"dstField1\", \"Bar\", \"dstField2\"]"`
}

type SetStringFromURL struct {
	// contains filtered or unexported fields
}

type SetStringFromURLConfig struct {
	Field   string   `help:"Name of the field to set to" required:"true"`
	Strings []string `help:"Strings to look for in the URL. Discard records not containing any of them." required:"true"`
}

type StringMatch struct {
	// contains filtered or unexported fields
}

type StringMatchConfig struct {
	Field       string   `help:"name of the field which value is used for string comparison" required:"true"`
	Strings     []string `help:"list of strings to match." required:"true"`
	InvertMatch bool     `help:"Invert the match outcome, so that records are discarded if they don't match any of the strings" default:"false"`
}

type Timestamp struct {
	// contains filtered or unexported fields
}

type TimestampConfig struct {
	Field string `help:"field to set to the unix Epoch timestamp" required:"true"`
}

type TimestampRange struct {
	// contains filtered or unexported fields
}

type TimestampRangeConfig struct {
	StartDatetime string `` /* 149-byte string literal not displayed */
	EndDatetime   string `` /* 149-byte string literal not displayed */
	Field         string `help:"Name of the field containing the Unix EPOCH timestamp" required:"true"`
}