Documentation
¶
Overview ¶
Package windowsevent contains utilities to transform Windows Event Log XML messages into structured messages for Datadog Logs.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Map ¶
Map is a wrapper around mxj.Map that provides additional methods to manipulate the map as it is used in the context of Windows Event Log messages.
func NewMapXML ¶
NewMapXML converts Windows Event Log XML to a map and runs some transforms to normalize the data.
Transforms:
- Event.EventData.Data: Convert to a map if values are named, else to a list
- Event.EventData.Binary: Convert to a string if it is a utf-16 string
- Event.System.EventID: Separate the EventID and Qualifier fields
func (*Map) GetMessage ¶
GetMessage returns the message field from the map.
func (*Map) JSON ¶
JSON returns the map as a JSON byte array.
The function replaces any "#text" key with a "value" key.
func (*Map) SetLevel ¶
SetLevel sets the level field in the map. This field is a DD field not a Windows Event Log field.
func (*Map) SetMessage ¶
SetMessage sets the message field in the map. This field is a DD field not a Windows Event Log field. The message is truncated if it is bigger than 128kB to prevent it from being dropped.
type Message ¶
type Message struct {
// contains filtered or unexported fields
}
Message implements StructedMessage interface for Windows Event Log messages.
func (*Message) GetContent ¶
GetContent returns the content part of the structured log.
func (*Message) Render ¶
Render renders the structured log information into JSON, for further encoding before being sent to the intake.
func (*Message) SetContent ¶
SetContent sets the content part of the structured log.
Source Files