static void
log_filter_pipe_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogFilterPipe *self = (LogFilterPipe *) s;
gchar buf[128];
gboolean res;
msg_debug("Filter rule evaluation begins",
evt_tag_str("rule", self->name),
evt_tag_str("location", log_expr_node_format_location(s->expr_node, buf, sizeof(buf))),
NULL);
if (self->expr->modify)
log_msg_make_writable(&msg, path_options);
res = filter_expr_eval(self->expr, msg);
msg_debug("Filter rule evaluation result",
evt_tag_str("result", res ? "match" : "not-match"),
evt_tag_str("rule", self->name),
evt_tag_str("location", log_expr_node_format_location(s->expr_node, buf, sizeof(buf))),
NULL);
if (res)
{
log_pipe_forward_msg(s, msg, path_options);
}
else
{
if (path_options->matched)
(*path_options->matched) = FALSE;
log_msg_drop(msg, path_options);
}
}
static gboolean
maxminddb_parser_process(LogParser *s, LogMessage **pmsg,
const LogPathOptions *path_options,
const gchar *input, gsize input_len)
{
GeoIPParser *self = (GeoIPParser *) s;
LogMessage *msg = log_msg_make_writable(pmsg, path_options);
msg_trace("geoip2-parser message processing started",
evt_tag_str ("input", input),
evt_tag_str ("prefix", self->prefix),
evt_tag_printf("msg", "%p", *pmsg));
MMDB_entry_data_list_s *entry_data_list;
if (!_mmdb_load_entry_data_list(self, input, &entry_data_list))
return TRUE;
GArray *path = g_array_new(TRUE, FALSE, sizeof(gchar *));
g_array_append_val(path, self->prefix);
gint status;
dump_geodata_into_msg(msg, entry_data_list, path, &status);
MMDB_free_entry_data_list(entry_data_list);
g_array_free(path, TRUE);
return TRUE;
}
static gboolean
date_parser_process(LogParser *s,
LogMessage **pmsg,
const LogPathOptions *path_options,
const gchar *input,
gsize input_len)
{
DateParser *self = (DateParser *) s;
LogMessage *msg = log_msg_make_writable(pmsg, path_options);
msg_trace("date-parser message processing started",
evt_tag_str ("input", input),
evt_tag_str ("format", self->date_format),
evt_tag_printf("msg", "%p", *pmsg));
/* this macro ensures zero termination by copying input to a
* g_alloca()-d buffer if necessary. In most cases it's not though.
*/
APPEND_ZERO(input, input, input_len);
gboolean res = _convert_timestamp_to_logstamp(self,
msg->timestamps[LM_TS_RECVD].ut_sec,
&msg->timestamps[self->time_stamp],
input);
return res;
}
static LogMessage *
create_clone(LogMessage *msg, LogPathOptions *path_options)
{
LogMessage *cloned = log_msg_ref(msg);
cloned = log_msg_make_writable(&cloned, path_options);
log_msg_add_ack(msg, path_options);
return cloned;
}
static gboolean
native_parser_process(LogParser *s, LogMessage **pmsg, const LogPathOptions *path_options, const gchar *input, gsize input_len)
{
ParserNative *self = (ParserNative *) s;
LogMessage *writable_msg = log_msg_make_writable(pmsg, path_options);
return native_parser_proxy_process(self->native_object, writable_msg, input, input_len);
}
static void
log_rewrite_unset_process(LogRewrite *s, LogMessage **pmsg, const LogPathOptions *path_options)
{
LogRewriteUnset *self = (LogRewriteUnset *) s;
log_msg_make_writable(pmsg, path_options);
log_msg_unset_value(*pmsg, self->super.value_handle);
}
gboolean
filter_expr_eval_root_with_context(FilterExprNode *self, LogMessage **msg, gint num_msg, const LogPathOptions *path_options)
{
if (self->modify)
log_msg_make_writable(&msg[0], path_options);
return filter_expr_eval_with_context(self, msg, num_msg);
}
static gboolean
geoip_parser_process(LogParser *s, LogMessage **pmsg,
const LogPathOptions *path_options,
const gchar *input, gsize input_len)
{
GeoIPParser *self = (GeoIPParser *) s;
LogMessage *msg = log_msg_make_writable(pmsg, path_options);
GeoIPRecord *record;
SBGString *value;
if (!self->dest.country_code &&
!self->dest.latitude &&
!self->dest.longitude)
return TRUE;
record = GeoIP_record_by_name(self->gi, input);
if (!record)
{
const char *country;
country = GeoIP_country_code_by_name(self->gi, input);
if (country)
log_msg_set_value_by_name(msg, self->dest.country_code,
country,
strlen(country));
return TRUE;
}
if (record->country_code)
log_msg_set_value_by_name(msg, self->dest.country_code,
record->country_code,
strlen(record->country_code));
value = sb_gstring_acquire();
g_string_printf(sb_gstring_string(value), "%f",
record->latitude);
log_msg_set_value_by_name(msg, self->dest.latitude,
sb_gstring_string(value)->str,
sb_gstring_string(value)->len);
g_string_printf(sb_gstring_string(value), "%f",
record->longitude);
log_msg_set_value_by_name(msg, self->dest.longitude,
sb_gstring_string(value)->str,
sb_gstring_string(value)->len);
GeoIPRecord_delete(record);
sb_gstring_release(value);
return TRUE;
}
static void
log_rewrite_set_process(LogRewrite *s, LogMessage **pmsg, const LogPathOptions *path_options)
{
LogRewriteSet *self = (LogRewriteSet *) s;
GString *result;
result = g_string_sized_new(64);
log_template_format(self->value_template, *pmsg, NULL, LTZ_LOCAL, 0, NULL, result);
log_msg_make_writable(pmsg, path_options);
log_msg_set_value(*pmsg, self->super.value_handle, result->str, result->len);
g_string_free(result, TRUE);
}
static gboolean
kv_parser_process(LogParser *s, LogMessage **pmsg, const LogPathOptions *path_options, const gchar *input, gsize input_len)
{
KVParser *self = (KVParser *) s;
log_msg_make_writable(pmsg, path_options);
/* FIXME: input length */
kv_scanner_input(self->kv_scanner, input);
while (kv_scanner_scan_next(self->kv_scanner))
{
/* FIXME: value length */
log_msg_set_value_by_name(*pmsg,
_get_formatted_key(self, kv_scanner_get_current_key(self->kv_scanner)),
kv_scanner_get_current_value(self->kv_scanner), -1);
}
return TRUE;
}
void
log_rewrite_subst_process(LogRewrite *s, LogMessage **pmsg, const LogPathOptions *path_options)
{
LogRewriteSubst *self = (LogRewriteSubst *) s;
const gchar *value;
gchar *new_value;
gssize length;
gssize new_length = -1;
value = log_msg_get_value(*pmsg, self->super.value_handle, &length);
log_msg_make_writable(pmsg, path_options);
new_value = log_matcher_replace(self->matcher, *pmsg, self->super.value_handle, value, length, self->replacement, &new_length);
if (new_value)
{
log_msg_set_value(*pmsg, self->super.value_handle, new_value, new_length);
}
g_free(new_value);
}
