Show s00 stats instead of "first_parser" (#2055)
* show s00 if verbose is provided * Clean up code * Fix failing test
This commit is contained in:
parent
ecb32d74c6
commit
5aca11af70
|
@ -396,25 +396,21 @@ func DumpTree(parser_results ParserResults, bucket_pour BucketPourInfo, opts Dum
|
||||||
detailsDisplay := ""
|
detailsDisplay := ""
|
||||||
|
|
||||||
if res {
|
if res {
|
||||||
if prev_item.Stage == "" {
|
changelog, _ := diff.Diff(prev_item, parsers[parser].Evt)
|
||||||
changeStr = "first_parser"
|
for _, change := range changelog {
|
||||||
} else {
|
switch change.Type {
|
||||||
changelog, _ := diff.Diff(prev_item, parsers[parser].Evt)
|
case "create":
|
||||||
for _, change := range changelog {
|
created++
|
||||||
switch change.Type {
|
detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s : %s\n", presep, sep, change.Type, strings.Join(change.Path, "."), green(change.To))
|
||||||
case "create":
|
case "update":
|
||||||
created++
|
detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s : %s -> %s\n", presep, sep, change.Type, strings.Join(change.Path, "."), change.From, yellow(change.To))
|
||||||
detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s : %s\n", presep, sep, change.Type, strings.Join(change.Path, "."), green(change.To))
|
if change.Path[0] == "Whitelisted" && change.To == true {
|
||||||
case "update":
|
whitelisted = true
|
||||||
detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s : %s -> %s\n", presep, sep, change.Type, strings.Join(change.Path, "."), change.From, yellow(change.To))
|
|
||||||
if change.Path[0] == "Whitelisted" && change.To == true {
|
|
||||||
whitelisted = true
|
|
||||||
}
|
|
||||||
updated++
|
|
||||||
case "delete":
|
|
||||||
deleted++
|
|
||||||
detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s\n", presep, sep, change.Type, red(strings.Join(change.Path, ".")))
|
|
||||||
}
|
}
|
||||||
|
updated++
|
||||||
|
case "delete":
|
||||||
|
deleted++
|
||||||
|
detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s\n", presep, sep, change.Type, red(strings.Join(change.Path, ".")))
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
prev_item = parsers[parser].Evt
|
prev_item = parsers[parser].Evt
|
||||||
|
|
2
tests/bats/testdata/explain/explain-log.txt
vendored
2
tests/bats/testdata/explain/explain-log.txt
vendored
|
@ -1,6 +1,6 @@
|
||||||
line: Sep 19 18:33:22 scw-d95986 sshd[24347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4
|
line: Sep 19 18:33:22 scw-d95986 sshd[24347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4
|
||||||
├ s00-raw
|
├ s00-raw
|
||||||
| └ 🟢 crowdsecurity/syslog-logs (first_parser)
|
| └ 🟢 crowdsecurity/syslog-logs (+12 ~9)
|
||||||
├ s01-parse
|
├ s01-parse
|
||||||
| └ 🟢 crowdsecurity/sshd-logs (+8 ~1)
|
| └ 🟢 crowdsecurity/sshd-logs (+8 ~1)
|
||||||
├ s02-enrich
|
├ s02-enrich
|
||||||
|
|
Loading…
Reference in a new issue