config

type APIConfig struct {
	// Transport specifies the underlying transport protocol for the API HTTP server.
	Transport string `json:"api.transport" yaml:"api.transport"`
	// Timeout determines the timeout for the API server responses
	Timeout time.Duration `json:"api.timeout" yaml:"api.timeout"`
}

type ActionContext struct {
	Kevt *kevent.Kevent
	// Kevts contains matched events for sequence group
	// policies indexed by `k` + the slot number of the
	// rule that produced a partial match
	Kevts map[string]*kevent.Kevent
	// Events contains a single element for non-sequence
	// group policies or a list of ordered matched events
	// for sequence group policies
	Events []*kevent.Kevent
	Filter *FilterConfig
	Group  FilterGroup
}

type FilamentConfig struct {
	Name        string
	Path        string
	FlushPeriod time.Duration
}

type FilterConfig struct {
	Name        string            `json:"name" yaml:"name"`
	Description string            `json:"description" yaml:"description"`
	Def         string            `json:"def" yaml:"def"` // deprecated in favor of `Condition`
	Condition   string            `json:"condition" yaml:"condition"`
	Action      string            `json:"action" yaml:"action"`
	Labels      map[string]string `json:"labels" yaml:"labels"`
}

type FilterGroup struct {
	Name        string              `json:"group" yaml:"group"`
	Description string              `json:"description" yaml:"description"`
	Enabled     *bool               `json:"enabled" yaml:"enabled"`
	Policy      FilterGroupPolicy   `json:"policy" yaml:"policy"`
	Relation    FilterGroupRelation `json:"relation" yaml:"relation"`
	Rules       []*FilterConfig     `json:"rules" yaml:"rules"`
	FromStrings []*FilterConfig     `json:"from-strings" yaml:"from-strings"` // deprecated in favor or `Rules`
	Tags        []string            `json:"tags" yaml:"tags"`
	Labels      map[string]string   `json:"labels" yaml:"labels"`
}

type FilterGroupPolicy uint8

type FilterGroupRelation uint8

type Filters struct {
	Rules  Rules  `json:"rules" yaml:"rules"`
	Macros Macros `json:"macros" yaml:"macros"`
	// contains filtered or unexported fields
}

type Macro struct {
	ID          string   `json:"macro" yaml:"macro"`
	Description string   `json:"description" yaml:"description"`
	Expr        string   `json:"expr" yaml:"expr"`
	List        []string `json:"list" yaml:"list"`
}

type Macros struct {
	FromPaths []string `json:"from-paths" yaml:"from-paths"`
}

type Rules struct {
	FromPaths []string `json:"from-paths" yaml:"from-paths"`
	FromURLs  []string `json:"from-urls" yaml:"from-urls"`
}