Documentation ¶
Index ¶
Constants ¶
View Source
const ( AWSApplicationLoadBalancerFormat = "aws_alb" AWSElasticLoadBalancerFormat = "aws_elb" AWSCloudFrontWebFormat = "aws_cf_web" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ALBEventParser ¶
type ALBEventParser struct {
// contains filtered or unexported fields
}
func NewALBEventParser ¶
func NewALBEventParser(opt *options.Options) *ALBEventParser
func (*ALBEventParser) DynSample ¶
func (ep *ALBEventParser) DynSample(in <-chan event.Event, out chan<- event.Event)
func (*ALBEventParser) ParseEvents ¶
func (ep *ALBEventParser) ParseEvents(obj state.DownloadedObject, out chan<- event.Event) error
type CloudFrontEventParser ¶
type CloudFrontEventParser struct {
// contains filtered or unexported fields
}
func NewCloudFrontEventParser ¶
func NewCloudFrontEventParser(opt *options.Options) *CloudFrontEventParser
func (*CloudFrontEventParser) DynSample ¶
func (ep *CloudFrontEventParser) DynSample(in <-chan event.Event, out chan<- event.Event)
func (*CloudFrontEventParser) ParseEvents ¶
func (ep *CloudFrontEventParser) ParseEvents(obj state.DownloadedObject, out chan<- event.Event) error
type CloudTrailEventParser ¶
type CloudTrailEventParser struct {
// contains filtered or unexported fields
}
func NewCloudTrailEventParser ¶
func NewCloudTrailEventParser(opt *options.Options) *CloudTrailEventParser
func (*CloudTrailEventParser) DynSample ¶
func (ep *CloudTrailEventParser) DynSample(in <-chan event.Event, out chan<- event.Event)
samples every rate for event TODO: how can we additionally filter this down to potentially interesting bits?
func (*CloudTrailEventParser) ParseEvents ¶
func (ep *CloudTrailEventParser) ParseEvents(obj state.DownloadedObject, out chan<- event.Event) error
we have to wrap events ourselves due to there being no existing parsers
type CloudTrailRecord ¶
type CloudTrailRecord struct { UserIdentity CloudTrailUserIdentity `json:"userIdentity"` EventTime string `json:"eventTime"` EventSource string `json:"eventSource"` EventName string `json:"eventName"` AwsRegion string `json:"awsRegion"` SourceIPAddress string `json:"sourceIPAddress"` UserAgent string `json:"userAgent"` Resources []CloudTrailResource `json:"resources"` EventType string `json:"eventType"` RequestParameters map[string]interface{} `json:"requestParameters"` }
type CloudTrailRecords ¶
type CloudTrailRecords struct {
Records []CloudTrailRecord `json:"Records"`
}
type CloudTrailResource ¶
type CloudTrailUserIdentity ¶
type ELBEventParser ¶
type ELBEventParser struct {
// contains filtered or unexported fields
}
func NewELBEventParser ¶
func NewELBEventParser(opt *options.Options) *ELBEventParser
func (*ELBEventParser) DynSample ¶
func (ep *ELBEventParser) DynSample(in <-chan event.Event, out chan<- event.Event)
func (*ELBEventParser) ParseEvents ¶
func (ep *ELBEventParser) ParseEvents(obj state.DownloadedObject, out chan<- event.Event) error
type EventParser ¶
type EventParser interface { // ParseEvents runs in a background goroutine and parses the downloaded // object, sending the events parsed from it further down the pipeline // using the output channel. er ParseEvents(obj state.DownloadedObject, out chan<- event.Event) error // DynSample dynamically samples events, reading them from `eventsCh` // and sending them to `sampledCh`. Behavior is dependent on the // publisher implementation, e.g., some fields might matter more for // ELB than for CloudFront. DynSample(in <-chan event.Event, out chan<- event.Event) }
type HoneycombPublisher ¶
type HoneycombPublisher struct { state.Stater EventParser APIHost string SampleRate int FinishedObjects chan string // contains filtered or unexported fields }
HoneycombPublisher implements Publisher and sends the entries provided to Honeycomb. Publisher allows us to have only one point of entry to sending events to Honeycomb (if desired), as well as isolate line parsing, sampling, and URL sub-parsing logic.
func NewHoneycombPublisher ¶
func NewHoneycombPublisher(opt *options.Options, stater state.Stater, eventParser EventParser) *HoneycombPublisher
func (*HoneycombPublisher) Close ¶
func (hp *HoneycombPublisher) Close()
Close flushes outstanding sends
func (*HoneycombPublisher) Publish ¶
func (hp *HoneycombPublisher) Publish(downloadedObj state.DownloadedObject) error
type Publisher ¶
type Publisher interface { // Publish accepts an io.Reader and scans it line-by-line, parses the // relevant event from each line (using EventParser), and sends to the // target (Honeycomb). Publish(f state.DownloadedObject) error }
Click to show internal directories.
Click to hide internal directories.