1 Star 0 Fork 0

sqos/beats

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
mongodb.go 10.04 KB
一键复制 编辑 原始数据 按行查看 历史
Steffen Siering 提交于 2016-11-14 14:50 . More Packetbeat cleanups (#2972)
package mongodb
import (
"expvar"
"fmt"
"strings"
"time"
"github.com/elastic/beats/libbeat/common"
"github.com/elastic/beats/libbeat/logp"
"github.com/elastic/beats/packetbeat/procs"
"github.com/elastic/beats/packetbeat/protos"
"github.com/elastic/beats/packetbeat/protos/tcp"
"github.com/elastic/beats/packetbeat/publish"
)
var debugf = logp.MakeDebug("mongodb")
type mongodbPlugin struct {
// config
ports []int
sendRequest bool
sendResponse bool
maxDocs int
maxDocLength int
requests *common.Cache
responses *common.Cache
transactionTimeout time.Duration
results publish.Transactions
}
type transactionKey struct {
tcp common.HashableTCPTuple
id int
}
var (
unmatchedRequests = expvar.NewInt("mongodb.unmatched_requests")
)
func init() {
protos.Register("mongodb", New)
}
func New(
testMode bool,
results publish.Transactions,
cfg *common.Config,
) (protos.Plugin, error) {
p := &mongodbPlugin{}
config := defaultConfig
if !testMode {
if err := cfg.Unpack(&config); err != nil {
return nil, err
}
}
if err := p.init(results, &config); err != nil {
return nil, err
}
return p, nil
}
func (mongodb *mongodbPlugin) init(results publish.Transactions, config *mongodbConfig) error {
debugf("Init a MongoDB protocol parser")
mongodb.setFromConfig(config)
mongodb.requests = common.NewCache(
mongodb.transactionTimeout,
protos.DefaultTransactionHashSize)
mongodb.requests.StartJanitor(mongodb.transactionTimeout)
mongodb.responses = common.NewCache(
mongodb.transactionTimeout,
protos.DefaultTransactionHashSize)
mongodb.responses.StartJanitor(mongodb.transactionTimeout)
mongodb.results = results
return nil
}
func (mongodb *mongodbPlugin) setFromConfig(config *mongodbConfig) {
mongodb.ports = config.Ports
mongodb.sendRequest = config.SendRequest
mongodb.sendResponse = config.SendResponse
mongodb.maxDocs = config.MaxDocs
mongodb.maxDocLength = config.MaxDocLength
mongodb.transactionTimeout = config.TransactionTimeout
}
func (mongodb *mongodbPlugin) GetPorts() []int {
return mongodb.ports
}
func (mongodb *mongodbPlugin) ConnectionTimeout() time.Duration {
return mongodb.transactionTimeout
}
func (mongodb *mongodbPlugin) Parse(
pkt *protos.Packet,
tcptuple *common.TCPTuple,
dir uint8,
private protos.ProtocolData,
) protos.ProtocolData {
defer logp.Recover("ParseMongodb exception")
debugf("Parse method triggered")
conn := ensureMongodbConnection(private)
conn = mongodb.doParse(conn, pkt, tcptuple, dir)
if conn == nil {
return nil
}
return conn
}
func ensureMongodbConnection(private protos.ProtocolData) *mongodbConnectionData {
if private == nil {
return &mongodbConnectionData{}
}
priv, ok := private.(*mongodbConnectionData)
if !ok {
logp.Warn("mongodb connection data type error, create new one")
return &mongodbConnectionData{}
}
if priv == nil {
debugf("Unexpected: mongodb connection data not set, create new one")
return &mongodbConnectionData{}
}
return priv
}
func (mongodb *mongodbPlugin) doParse(
conn *mongodbConnectionData,
pkt *protos.Packet,
tcptuple *common.TCPTuple,
dir uint8,
) *mongodbConnectionData {
st := conn.streams[dir]
if st == nil {
st = newStream(pkt, tcptuple)
conn.streams[dir] = st
debugf("new stream: %p (dir=%v, len=%v)", st, dir, len(pkt.Payload))
} else {
// concatenate bytes
st.data = append(st.data, pkt.Payload...)
if len(st.data) > tcp.TCPMaxDataInStream {
debugf("Stream data too large, dropping TCP stream")
conn.streams[dir] = nil
return conn
}
}
for len(st.data) > 0 {
if st.message == nil {
st.message = &mongodbMessage{ts: pkt.Ts}
}
ok, complete := mongodbMessageParser(st)
if !ok {
// drop this tcp stream. Will retry parsing with the next
// segment in it
conn.streams[dir] = nil
debugf("Ignore Mongodb message. Drop tcp stream. Try parsing with the next segment")
return conn
}
if !complete {
// wait for more data
debugf("MongoDB wait for more data before parsing message")
break
}
// all ok, go to next level and reset stream for new message
debugf("MongoDB message complete")
mongodb.handleMongodb(conn, st.message, tcptuple, dir)
st.PrepareForNewMessage()
}
return conn
}
func newStream(pkt *protos.Packet, tcptuple *common.TCPTuple) *stream {
s := &stream{
tcptuple: tcptuple,
data: pkt.Payload,
message: &mongodbMessage{ts: pkt.Ts},
}
return s
}
func (mongodb *mongodbPlugin) handleMongodb(
conn *mongodbConnectionData,
m *mongodbMessage,
tcptuple *common.TCPTuple,
dir uint8,
) {
m.tcpTuple = *tcptuple
m.direction = dir
m.cmdlineTuple = procs.ProcWatcher.FindProcessesTuple(tcptuple.IPPort())
if m.isResponse {
debugf("MongoDB response message")
mongodb.onResponse(conn, m)
} else {
debugf("MongoDB request message")
mongodb.onRequest(conn, m)
}
}
func (mongodb *mongodbPlugin) onRequest(conn *mongodbConnectionData, msg *mongodbMessage) {
// publish request only transaction
if !awaitsReply(msg.opCode) {
mongodb.onTransComplete(msg, nil)
return
}
id := msg.requestID
key := transactionKey{tcp: msg.tcpTuple.Hashable(), id: id}
// try to find matching response potentially inserted before
if v := mongodb.responses.Delete(key); v != nil {
resp := v.(*mongodbMessage)
mongodb.onTransComplete(msg, resp)
return
}
// insert into cache for correlation
old := mongodb.requests.Put(key, msg)
if old != nil {
debugf("Two requests without a Response. Dropping old request")
unmatchedRequests.Add(1)
}
}
func (mongodb *mongodbPlugin) onResponse(conn *mongodbConnectionData, msg *mongodbMessage) {
id := msg.responseTo
key := transactionKey{tcp: msg.tcpTuple.Hashable(), id: id}
// try to find matching request
if v := mongodb.requests.Delete(key); v != nil {
requ := v.(*mongodbMessage)
mongodb.onTransComplete(requ, msg)
return
}
// insert into cache for correlation
mongodb.responses.Put(key, msg)
}
func (mongodb *mongodbPlugin) onTransComplete(requ, resp *mongodbMessage) {
trans := newTransaction(requ, resp)
debugf("Mongodb transaction completed: %s", trans.mongodb)
mongodb.publishTransaction(trans)
}
func newTransaction(requ, resp *mongodbMessage) *transaction {
trans := &transaction{}
// fill request
if requ != nil {
trans.mongodb = common.MapStr{}
trans.event = requ.event
trans.method = requ.method
trans.cmdline = requ.cmdlineTuple
trans.ts = requ.ts
trans.src = common.Endpoint{
IP: requ.tcpTuple.SrcIP.String(),
Port: requ.tcpTuple.SrcPort,
Proc: string(requ.cmdlineTuple.Src),
}
trans.dst = common.Endpoint{
IP: requ.tcpTuple.DstIP.String(),
Port: requ.tcpTuple.DstPort,
Proc: string(requ.cmdlineTuple.Dst),
}
if requ.direction == tcp.TCPDirectionReverse {
trans.src, trans.dst = trans.dst, trans.src
}
trans.params = requ.params
trans.resource = requ.resource
trans.bytesIn = requ.messageLength
}
// fill response
if resp != nil {
for k, v := range resp.event {
trans.event[k] = v
}
trans.error = resp.error
trans.documents = resp.documents
trans.responseTime = int32(resp.ts.Sub(trans.ts).Nanoseconds() / 1e6) // resp_time in milliseconds
trans.bytesOut = resp.messageLength
}
return trans
}
func (mongodb *mongodbPlugin) GapInStream(tcptuple *common.TCPTuple, dir uint8,
nbytes int, private protos.ProtocolData) (priv protos.ProtocolData, drop bool) {
return private, true
}
func (mongodb *mongodbPlugin) ReceivedFin(tcptuple *common.TCPTuple, dir uint8,
private protos.ProtocolData) protos.ProtocolData {
return private
}
func copyMapWithoutKey(d map[string]interface{}, key string) map[string]interface{} {
res := map[string]interface{}{}
for k, v := range d {
if k != key {
res[k] = v
}
}
return res
}
func reconstructQuery(t *transaction, full bool) (query string) {
query = t.resource + "." + t.method + "("
if len(t.params) > 0 {
var err error
var params string
if !full {
// remove the actual data.
// TODO: review if we need to add other commands here
if t.method == "insert" {
params, err = doc2str(copyMapWithoutKey(t.params, "documents"))
} else if t.method == "update" {
params, err = doc2str(copyMapWithoutKey(t.params, "updates"))
} else if t.method == "findandmodify" {
params, err = doc2str(copyMapWithoutKey(t.params, "update"))
}
} else {
params, err = doc2str(t.params)
}
if err != nil {
debugf("Error marshaling params: %v", err)
} else {
query += params
}
}
query += ")"
skip, _ := t.event["numberToSkip"].(int)
if skip > 0 {
query += fmt.Sprintf(".skip(%d)", skip)
}
limit, _ := t.event["numberToReturn"].(int)
if limit > 0 && limit < 0x7fffffff {
query += fmt.Sprintf(".limit(%d)", limit)
}
return
}
func (mongodb *mongodbPlugin) publishTransaction(t *transaction) {
if mongodb.results == nil {
debugf("Try to publish transaction with null results")
return
}
event := common.MapStr{}
event["type"] = "mongodb"
if t.error == "" {
event["status"] = common.OK_STATUS
} else {
t.event["error"] = t.error
event["status"] = common.ERROR_STATUS
}
event["mongodb"] = t.event
event["method"] = t.method
event["resource"] = t.resource
event["query"] = reconstructQuery(t, false)
event["responsetime"] = t.responseTime
event["bytes_in"] = uint64(t.bytesIn)
event["bytes_out"] = uint64(t.bytesOut)
event["@timestamp"] = common.Time(t.ts)
event["src"] = &t.src
event["dst"] = &t.dst
if mongodb.sendRequest {
event["request"] = reconstructQuery(t, true)
}
if mongodb.sendResponse {
if len(t.documents) > 0 {
// response field needs to be a string
docs := make([]string, 0, len(t.documents))
for i, doc := range t.documents {
if mongodb.maxDocs > 0 && i >= mongodb.maxDocs {
docs = append(docs, "[...]")
break
}
str, err := doc2str(doc)
if err != nil {
logp.Warn("Failed to JSON marshal document from Mongo: %v (error: %v)", doc, err)
} else {
if mongodb.maxDocLength > 0 && len(str) > mongodb.maxDocLength {
str = str[:mongodb.maxDocLength] + " ..."
}
docs = append(docs, str)
}
}
event["response"] = strings.Join(docs, "\n")
}
}
mongodb.results.PublishTransaction(event)
}
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/sqos/beats.git
git@gitee.com:sqos/beats.git
sqos
beats
beats
v5.6.0

搜索帮助