beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

export node logger (#537)

Browse source
This commit is contained in:
registergoofy 2020-12-14 14:12:22 +01:00 committed by GitHub
parent f2b30db684
commit 13881edbaa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 22 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
pkg/parser/node.go
View file

@ -27,8 +27,8 @@ type Node struct {
Author string `yaml:"author,omitempty"` Author string `yaml:"author,omitempty"`
Description string `yaml:"description,omitempty"` Description string `yaml:"description,omitempty"`
Rerferences []string `yaml:"references,omitempty"` Rerferences []string `yaml:"references,omitempty"`
//if debug is present in the node, keep its specific logger in runtime structure //if debug is present in the node, keep its specific Logger in runtime structure
logger *log.Entry `yaml:"-"` Logger *log.Entry `yaml:"-"`
//This is mostly a hack to make writting less repetive. //This is mostly a hack to make writting less repetive.
//relying on stage, we know which field to parse, and we //relying on stage, we know which field to parse, and we
//can as well promote log to next stage on success //can as well promote log to next stage on success
@ -111,7 +111,7 @@ func (n *Node) validate(pctx *UnixParserCtx, ectx []EnricherCtx) error {
func (n *Node) process(p *types.Event, ctx UnixParserCtx) (bool, error) { func (n *Node) process(p *types.Event, ctx UnixParserCtx) (bool, error) {
var NodeState bool var NodeState bool
clog := n.logger clog := n.Logger
clog.Tracef("Event entering node") clog.Tracef("Event entering node")
if n.RunTimeFilter != nil { if n.RunTimeFilter != nil {
@ -369,21 +369,21 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx []EnricherCtx) error {
log.Fatalf("While creating bucket-specific logger : %s", err) log.Fatalf("While creating bucket-specific logger : %s", err)
} }
clog.SetLevel(log.DebugLevel) clog.SetLevel(log.DebugLevel)
n.logger = clog.WithFields(log.Fields{ n.Logger = clog.WithFields(log.Fields{
"id": n.rn, "id": n.rn,
}) })
n.logger.Infof("%s has debug enabled", n.Name) n.Logger.Infof("%s has debug enabled", n.Name)
} else { } else {
/* else bind it to the default one (might find something more elegant here)*/ /* else bind it to the default one (might find something more elegant here)*/
n.logger = log.WithFields(log.Fields{ n.Logger = log.WithFields(log.Fields{
"id": n.rn, "id": n.rn,
}) })
} }
/* display info about top-level nodes, they should be the only one with explicit stage name ?*/ /* display info about top-level nodes, they should be the only one with explicit stage name ?*/
n.logger = n.logger.WithFields(log.Fields{"stage": n.Stage, "name": n.Name}) n.Logger = n.Logger.WithFields(log.Fields{"stage": n.Stage, "name": n.Name})
n.logger.Tracef("Compiling : %s", dumpr.Sdump(n)) n.Logger.Tracef("Compiling : %s", dumpr.Sdump(n))
//compile filter if present //compile filter if present
if n.Filter != "" { if n.Filter != "" {
@ -403,15 +403,15 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx []EnricherCtx) error {
/* handle pattern_syntax and groks */ /* handle pattern_syntax and groks */
for node, pattern := range n.SubGroks { for node, pattern := range n.SubGroks {
n.logger.Tracef("Adding subpattern '%s' : '%s'", node, pattern) n.Logger.Tracef("Adding subpattern '%s' : '%s'", node, pattern)
if err := pctx.Grok.Add(node, pattern); err != nil { if err := pctx.Grok.Add(node, pattern); err != nil {
n.logger.Errorf("Unable to compile subpattern %s : %v", node, err) n.Logger.Errorf("Unable to compile subpattern %s : %v", node, err)
return err return err
} }
} }
/* load grok by name or compile in-place */ /* load grok by name or compile in-place */
if n.Grok.RegexpName != "" { if n.Grok.RegexpName != "" {
n.logger.Tracef("+ Regexp Compilation '%s'", n.Grok.RegexpName) n.Logger.Tracef("+ Regexp Compilation '%s'", n.Grok.RegexpName)
n.Grok.RunTimeRegexp, err = pctx.Grok.Get(n.Grok.RegexpName) n.Grok.RunTimeRegexp, err = pctx.Grok.Get(n.Grok.RegexpName)
if err != nil { if err != nil {
return fmt.Errorf("Unable to find grok '%s' : %v", n.Grok.RegexpName, err) return fmt.Errorf("Unable to find grok '%s' : %v", n.Grok.RegexpName, err)
@ -419,11 +419,11 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx []EnricherCtx) error {
if n.Grok.RunTimeRegexp == nil { if n.Grok.RunTimeRegexp == nil {
return fmt.Errorf("Empty grok '%s'", n.Grok.RegexpName) return fmt.Errorf("Empty grok '%s'", n.Grok.RegexpName)
} }
n.logger.Tracef("%s regexp: %s", n.Grok.RegexpName, n.Grok.RunTimeRegexp.Regexp.String()) n.Logger.Tracef("%s regexp: %s", n.Grok.RegexpName, n.Grok.RunTimeRegexp.Regexp.String())
valid = true valid = true
} else if n.Grok.RegexpValue != "" { } else if n.Grok.RegexpValue != "" {
if strings.HasSuffix(n.Grok.RegexpValue, "\n") { if strings.HasSuffix(n.Grok.RegexpValue, "\n") {
n.logger.Debugf("Beware, pattern ends with \\n : '%s'", n.Grok.RegexpValue) n.Logger.Debugf("Beware, pattern ends with \\n : '%s'", n.Grok.RegexpValue)
} }
n.Grok.RunTimeRegexp, err = pctx.Grok.Compile(n.Grok.RegexpValue) n.Grok.RunTimeRegexp, err = pctx.Grok.Compile(n.Grok.RegexpValue)
if err != nil { if err != nil {
@ -433,7 +433,7 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx []EnricherCtx) error {
// We shouldn't be here because compilation succeeded, so regexp shouldn't be nil // We shouldn't be here because compilation succeeded, so regexp shouldn't be nil
return fmt.Errorf("Grok compilation failure: %s", n.Grok.RegexpValue) return fmt.Errorf("Grok compilation failure: %s", n.Grok.RegexpValue)
} }
n.logger.Tracef("%s regexp : %s", n.Grok.RegexpValue, n.Grok.RunTimeRegexp.Regexp.String()) n.Logger.Tracef("%s regexp : %s", n.Grok.RegexpValue, n.Grok.RunTimeRegexp.Regexp.String())
valid = true valid = true
} }
/* load grok statics */ /* load grok statics */
@ -476,7 +476,7 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx []EnricherCtx) error {
if n.Statics[idx].ExpValue != "" { if n.Statics[idx].ExpValue != "" {
n.Statics[idx].RunTimeValue, err = expr.Compile(n.Statics[idx].ExpValue, expr.Env(exprhelpers.GetExprEnv(map[string]interface{}{"evt": &types.Event{}}))) n.Statics[idx].RunTimeValue, err = expr.Compile(n.Statics[idx].ExpValue, expr.Env(exprhelpers.GetExprEnv(map[string]interface{}{"evt": &types.Event{}})))
if err != nil { if err != nil {
n.logger.Errorf("Statics Compilation failed %v.", err) n.Logger.Errorf("Statics Compilation failed %v.", err)
return err return err
} }
} }
@ -486,36 +486,36 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx []EnricherCtx) error {
/* compile whitelists if present */ /* compile whitelists if present */
for _, v := range n.Whitelist.Ips { for _, v := range n.Whitelist.Ips {
n.Whitelist.B_Ips = append(n.Whitelist.B_Ips, net.ParseIP(v)) n.Whitelist.B_Ips = append(n.Whitelist.B_Ips, net.ParseIP(v))
n.logger.Debugf("adding ip %s to whitelists", net.ParseIP(v)) n.Logger.Debugf("adding ip %s to whitelists", net.ParseIP(v))
valid = true valid = true
} }
for _, v := range n.Whitelist.Cidrs { for _, v := range n.Whitelist.Cidrs {
_, tnet, err := net.ParseCIDR(v) _, tnet, err := net.ParseCIDR(v)
if err != nil { if err != nil {
n.logger.Fatalf("Unable to parse cidr whitelist '%s' : %v.", v, err) n.Logger.Fatalf("Unable to parse cidr whitelist '%s' : %v.", v, err)
} }
n.Whitelist.B_Cidrs = append(n.Whitelist.B_Cidrs, tnet) n.Whitelist.B_Cidrs = append(n.Whitelist.B_Cidrs, tnet)
n.logger.Debugf("adding cidr %s to whitelists", tnet) n.Logger.Debugf("adding cidr %s to whitelists", tnet)
valid = true valid = true
} }
for _, filter := range n.Whitelist.Exprs { for _, filter := range n.Whitelist.Exprs {
expression := &types.ExprWhitelist{} expression := &types.ExprWhitelist{}
expression.Filter, err = expr.Compile(filter, expr.Env(exprhelpers.GetExprEnv(map[string]interface{}{"evt": &types.Event{}}))) expression.Filter, err = expr.Compile(filter, expr.Env(exprhelpers.GetExprEnv(map[string]interface{}{"evt": &types.Event{}})))
if err != nil { if err != nil {
n.logger.Fatalf("Unable to compile whitelist expression '%s' : %v.", filter, err) n.Logger.Fatalf("Unable to compile whitelist expression '%s' : %v.", filter, err)
} }
expression.ExprDebugger, err = exprhelpers.NewDebugger(filter, expr.Env(exprhelpers.GetExprEnv(map[string]interface{}{"evt": &types.Event{}}))) expression.ExprDebugger, err = exprhelpers.NewDebugger(filter, expr.Env(exprhelpers.GetExprEnv(map[string]interface{}{"evt": &types.Event{}})))
if err != nil { if err != nil {
log.Errorf("unable to build debug filter for '%s' : %s", filter, err) log.Errorf("unable to build debug filter for '%s' : %s", filter, err)
} }
n.Whitelist.B_Exprs = append(n.Whitelist.B_Exprs, expression) n.Whitelist.B_Exprs = append(n.Whitelist.B_Exprs, expression)
n.logger.Debugf("adding expression %s to whitelists", filter) n.Logger.Debugf("adding expression %s to whitelists", filter)
valid = true valid = true
} }
if !valid { if !valid {
/* node is empty, error force return */ /* node is empty, error force return */
n.logger.Infof("Node is empty: %s", spew.Sdump(n)) n.Logger.Infof("Node is empty: %s", spew.Sdump(n))
n.Stage = "" n.Stage = ""
} }
if err := n.validate(pctx, ectx); err != nil { if err := n.validate(pctx, ectx); err != nil {

2
pkg/parser/runtime.go
View file

@ -109,7 +109,7 @@ func (n *Node) ProcessStatics(statics []types.ExtraField, event *types.Event) er
//we have a few cases : //we have a few cases :
//(meta||key) + (static||reference||expr) //(meta||key) + (static||reference||expr)
var value string var value string
clog := n.logger clog := n.Logger
for _, static := range statics { for _, static := range statics {
value = "" value = ""