代码拉取完成,页面将自动刷新
package add_kubernetes_metadata
import (
"fmt"
"sync"
"github.com/elastic/beats/libbeat/beat"
"github.com/elastic/beats/libbeat/common"
"github.com/elastic/beats/libbeat/common/fmtstr"
"github.com/elastic/beats/libbeat/logp"
"github.com/elastic/beats/libbeat/outputs/codec"
"github.com/elastic/beats/libbeat/outputs/codec/format"
)
const (
FieldMatcherName = "fields"
FieldFormatMatcherName = "field_format"
)
// Matcher takes a new event and returns the index
type Matcher interface {
// MetadataIndex returns the index string to use in annotation lookups for the given
// event. A previous indexer should have generated that index for this to work
// This function can return "" if the event doesn't match
MetadataIndex(event common.MapStr) string
}
type Matchers struct {
sync.RWMutex
matchers []Matcher
}
type MatcherConstructor func(config common.Config) (Matcher, error)
func NewMatchers(configs PluginConfig) *Matchers {
matchers := []Matcher{}
for _, pluginConfigs := range configs {
for name, pluginConfig := range pluginConfigs {
matchFunc := Indexing.GetMatcher(name)
if matchFunc == nil {
logp.Warn("Unable to find matcher plugin %s", name)
continue
}
matcher, err := matchFunc(pluginConfig)
if err != nil {
logp.Warn("Unable to initialize matcher plugin %s due to error %v", name, err)
}
matchers = append(matchers, matcher)
}
}
return &Matchers{
matchers: matchers,
}
}
// MetadataIndex returns the index string for the first matcher from the Registry returning one
func (m *Matchers) MetadataIndex(event common.MapStr) string {
m.RLock()
defer m.RUnlock()
for _, matcher := range m.matchers {
index := matcher.MetadataIndex(event)
if index != "" {
return index
}
}
// No index returned
return ""
}
func (m *Matchers) Empty() bool {
if len(m.matchers) == 0 {
return true
}
return false
}
type FieldMatcher struct {
MatchFields []string
}
func NewFieldMatcher(cfg common.Config) (Matcher, error) {
config := struct {
LookupFields []string `config:"lookup_fields"`
}{}
err := cfg.Unpack(&config)
if err != nil {
return nil, fmt.Errorf("fail to unpack the `lookup_fields` configuration: %s", err)
}
if len(config.LookupFields) == 0 {
return nil, fmt.Errorf("lookup_fields can not be empty")
}
return &FieldMatcher{MatchFields: config.LookupFields}, nil
}
func (f *FieldMatcher) MetadataIndex(event common.MapStr) string {
for _, field := range f.MatchFields {
keyIface, err := event.GetValue(field)
if err == nil {
key, ok := keyIface.(string)
if ok {
return key
}
}
}
return ""
}
type FieldFormatMatcher struct {
Codec codec.Codec
}
func NewFieldFormatMatcher(cfg common.Config) (Matcher, error) {
config := struct {
Format string `config:"format"`
}{}
err := cfg.Unpack(&config)
if err != nil {
return nil, fmt.Errorf("fail to unpack the `format` configuration of `field_format` matcher: %s", err)
}
if config.Format == "" {
return nil, fmt.Errorf("`format` of `field_format` matcher can't be empty")
}
return &FieldFormatMatcher{
Codec: format.New(fmtstr.MustCompileEvent(config.Format)),
}, nil
}
func (f *FieldFormatMatcher) MetadataIndex(event common.MapStr) string {
bytes, err := f.Codec.Encode("", &beat.Event{
Fields: event,
})
if err != nil {
logp.Debug("kubernetes", "Unable to apply field format pattern on event")
}
if len(bytes) == 0 {
return ""
}
return string(bytes)
}
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。