filtercond

package
v0.0.0-...-c13075e Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 20, 2024 License: MIT Imports: 9 Imported by: 0

README

gogstash cond filter module

Condition syntax depends govaluate:

Only boolean true for the result value is considered to be eligible.

Built-in functions:

  • empty() Checks if the argument is nil
  • strlen() Returns the string argument's length
  • map() Maps slice to []interface{}
  • rand() Returns a pseudo-random number in [0.0, 1.0) as a float64

Synopsis

filter:
  - type: cond
    # (required) condition need to be satisfied
    condition: "level == 'ERROR'"
    # (required) filter config
    filter:
      - type: add_field
        key: foo
        value: bar
    # (optional) filter config when condition was not met
    else_filter:
      - type: add_field
        key: foo
        value: bar2

filter:
  - type: cond
    # (required) condition need to be satisfied
    condition: "!('gogstash_filter_grok_error' IN map([tags]))"
    # (required) filter config
    filter:
      - type: remove_field
        remove_message: true

Documentation

Index

Constants

View Source 
const ErrorTag = "gogstash_filter_cond_error"

ErrorTag tag added to event when process geoip2 failed

View Source 
const ModuleName = "cond"

ModuleName is the name used in config file

Variables

View Source 
var (
	ErrorBuiltInFunctionParameters1 = errutil.NewFactory("Built-in function '%s' parameters error")
	BuiltInFunctions                = map[string]govaluate.ExpressionFunction{
		"empty": func(args ...any) (any, error) {
			if len(args) > 1 {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "empty")
			} else if len(args) == 0 {
				return true, nil
			}
			return args[0] == nil, nil
		},
		"strlen": func(args ...any) (any, error) {
			if len(args) > 1 {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "strlen")
			} else if len(args) == 0 {
				return float64(0), nil
			}
			length := len(args[0].(string))
			return float64(length), nil
		},
		"map": func(args ...any) (any, error) {
			if len(args) > 1 {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "map")
			} else if len(args) == 0 {
				return []any{}, nil
			}

			s := reflect.ValueOf(args[0])
			if s.Kind() != reflect.Slice {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "map")
			}

			ret := make([]any, s.Len())

			for i := 0; i < s.Len(); i++ {
				ret[i] = s.Index(i).Interface()
			}

			return ret, nil
		},
		"rand": func(args ...any) (any, error) {
			if len(args) > 0 {
				return nil, ErrorBuiltInFunctionParameters1.New(nil, "rand")
			}
			return rand.Float64(), nil
		},
	}
)

built-in functions

Functions

func InitHandler 

func InitHandler(
	ctx context.Context,
	raw config.ConfigRaw,
	control config.Control,
) (config.TypeFilterConfig, error)

InitHandler initialize the filter plugin

Types

type EventParameters 

type EventParameters struct {
	Event *logevent.LogEvent
}

EventParameters pack event's parameters by member function `Get` access

func (*EventParameters) Get 

func (ep *EventParameters) Get(field string) (any, error)

Get obtaining value from event's specified field recursively

type FilterConfig 

type FilterConfig struct {
	config.FilterConfig

	Condition     string             `json:"condition"`   // condition need to be satisfied
	FilterRaw     []config.ConfigRaw `json:"filter"`      // filters when satisfy the condition
	ElseFilterRaw []config.ConfigRaw `json:"else_filter"` // filters when does not met the condition
	// contains filtered or unexported fields
}

FilterConfig holds the configuration json fields and internal objects

func DefaultFilterConfig 

func DefaultFilterConfig() FilterConfig

DefaultFilterConfig returns an FilterConfig struct with default values

func (*FilterConfig) Event 

func (f *FilterConfig) Event(
	ctx context.Context,
	event logevent.LogEvent,
) (logevent.LogEvent, bool)

Event the main filter event

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.