engine

Documentation

Index

• type CatEvaluator
• type CatEvaluatorKind
• type CompareCondRepo
  • func RuleEngineRepoToCompareCondRepo(repo *RuleEngineRepo) (*CompareCondRepo, error)
  • func (repo *CompareCondRepo) ConvertToCategoryCondition(c condition.Condition, parentScope *ForEachScope) condition.Condition
  • func (repo *CompareCondRepo) DiscardEvalCategoryRec(evalCategoryRec *EvalCategoryRec)
  • func (repo *CompareCondRepo) NewEvalCategoryRec(eval condition.Operand) *EvalCategoryRec
• type EvalCategoryRec
  • func (v *EvalCategoryRec) Equals(element immutable.SetElement) bool
  • func (v *EvalCategoryRec) Evaluate(event *objectmap.ObjectAttributeMap, frames []interface{}) condition.Operand
  • func (v *EvalCategoryRec) GetCategory() types.Category
  • func (v *EvalCategoryRec) GetHash() uint64
• type EvalCondFunc
• type ExternalRule
• type ForEachScope
  • func (scope *ForEachScope) ResetEvaluator()
• type GeneralRuleRecord
• type InternalRule
• type RepoInterface
• type RuleApi
  • func NewRuleApi(ctx *types.AppContext) *RuleApi
  • func (api *RuleApi) ReadRules(r io.Reader, fileType string) ([]InternalRule, error)
• type RuleEngine
  • func NewRuleEngine(repo *RuleEngineRepo) (*RuleEngine, error)
  • func (f *RuleEngine) GetRuleDefinition(ruleId uint) *InternalRule
  • func (f *RuleEngine) MatchEvent(v interface{}) []condition.RuleIdType
• type RuleEngineMetrics
• type RuleEngineRepo
  • func NewRuleEngineRepo() *RuleEngineRepo
  • func (repo *RuleEngineRepo) GetAppCtx() *types.AppContext
  • func (repo *RuleEngineRepo) MapScalar(v interface{}) interface{}
  • func (repo *RuleEngineRepo) Register(f *InternalRule) uint
  • func (repo *RuleEngineRepo) RegisterRuleFromString(rule string, format string) (uint, error)
  • func (repo *RuleEngineRepo) RegisterRulesFromFile(path string) ([]uint, error)
• type StringMatcher
  • func NewStringMatcher() *StringMatcher
  • func (sm *StringMatcher) AddPattern(pattern string, category condition.Operand)
  • func (sm *StringMatcher) Build()
  • func (sm *StringMatcher) Match(text string) []condition.Operand

Types

type CatEvaluator

type CatEvaluator interface {
	Evaluate(event *objectmap.ObjectAttributeMap, frames []interface{}) (bool, error)
	GetCategory() types.Category
	immutable.SetElement
}

type CatEvaluatorKind

type CatEvaluatorKind int8

type CompareCondRepo

type CompareCondRepo struct {
	AttributeToCompareCondRecord map[string]*hashset.Set[*EvalCategoryRec]
	CondToCompareCondRecord      *hashmap.Map[condition.Condition, *EvalCategoryRec]
	CondToCategoryMap            *hashmap.Map[condition.Condition, *hashmap.Map[condition.Operand, []condition.Operand]]
	CondToStringMatcher          *hashmap.Map[condition.Condition, *StringMatcher]
	EvalCategoryRecs             []*EvalCategoryRec
	RuleRepo                     condition.RuleRepo
	ObjectAttributeMapper        *objectmap.ObjectAttributeMapper
	CondFactory                  *condition.Factory
	// contains filtered or unexported fields
}

CompareCondRepo contains mappings between filter Compare Conditions and attributes assigned to them. Identical Compare Conditions will be mapped to the same category.

func RuleEngineRepoToCompareCondRepo

func RuleEngineRepoToCompareCondRepo(repo *RuleEngineRepo) (*CompareCondRepo, error)

func (*CompareCondRepo) ConvertToCategoryCondition

func (repo *CompareCondRepo) ConvertToCategoryCondition(c condition.Condition, parentScope *ForEachScope) condition.Condition

ConvertToCategoryCondition this has to be called from the root condition or and/or/not boolean operator

func (*CompareCondRepo) DiscardEvalCategoryRec

func (repo *CompareCondRepo) DiscardEvalCategoryRec(evalCategoryRec *EvalCategoryRec)

func (*CompareCondRepo) NewEvalCategoryRec

func (repo *CompareCondRepo) NewEvalCategoryRec(eval condition.Operand) *EvalCategoryRec

type EvalCategoryRec

type EvalCategoryRec struct {
	Cat      types.Category
	Eval     condition.Operand
	AttrKeys []string
}

func (*EvalCategoryRec) Equals

func (v *EvalCategoryRec) Equals(element immutable.SetElement) bool

func (*EvalCategoryRec) Evaluate

func (v *EvalCategoryRec) Evaluate(event *objectmap.ObjectAttributeMap, frames []interface{}) condition.Operand

func (*EvalCategoryRec) GetCategory

func (v *EvalCategoryRec) GetCategory() types.Category

func (*EvalCategoryRec) GetHash

func (v *EvalCategoryRec) GetHash() uint64

type EvalCondFunc

type EvalCondFunc func(event *objectmap.ObjectAttributeMap, frames []interface{}) (bool, error)

type ExternalRule

type ExternalRule struct {
	Metadata   map[string]interface{} `json:"metadata,omitempty"`
	Expression string                 `json:"expression"`
}

type ForEachScope

type ForEachScope struct {
	// Path, e.g. $.members or $member.children.
	// Each path consist of the outer path reference (e.g. $ for root or $member for path to
	// the member element) and the path to a nested array element.  The address of the denoted
	// element is therefore a concatenation of the address of the parent element's path
	// and the address of the path of the current element.
	Path         string
	Element      string
	NestingLevel int
	ParentScope  *ForEachScope
	Evaluator    *EvalCategoryRec
	AttrDictRec  *objectmap.AttrDictionaryRec
}

ForEachScope keeps track of the local scope data. Each for_all, for_some or for_each filter element starts a new scope with its index element and path pointing to the data attribute over which the element iterates in this scope. The scope's element is available from all the nested scopes both during the filter build time as the parentScope parameter and at runtime via array of attribute addresses, one for each ancestor scope.

func (*ForEachScope) ResetEvaluator

func (scope *ForEachScope) ResetEvaluator()

type GeneralRuleRecord

type GeneralRuleRecord struct {
	// contains filtered or unexported fields
}

type InternalRule

type InternalRule struct {
	Metadata  map[string]interface{}
	Condition condition.Condition
}

type RepoInterface

type RepoInterface interface {
	Register(f *InternalRule)
}

type RuleApi

type RuleApi struct {
	// contains filtered or unexported fields
}

func NewRuleApi

func NewRuleApi(ctx *types.AppContext) *RuleApi

func (*RuleApi) ReadRules

func (api *RuleApi) ReadRules(r io.Reader, fileType string) ([]InternalRule, error)

type RuleEngine

type RuleEngine struct {
	Metrics RuleEngineMetrics
	// contains filtered or unexported fields
}

func NewRuleEngine

func NewRuleEngine(repo *RuleEngineRepo) (*RuleEngine, error)

func (*RuleEngine) GetRuleDefinition

func (f *RuleEngine) GetRuleDefinition(ruleId uint) *InternalRule

func (*RuleEngine) MatchEvent

func (f *RuleEngine) MatchEvent(v interface{}) []condition.RuleIdType

type RuleEngineMetrics

type RuleEngineMetrics struct {
	NumCatEvals uint64
}

type RuleEngineRepo

type RuleEngineRepo struct {
	Rules []*GeneralRuleRecord
	// contains filtered or unexported fields
}

func NewRuleEngineRepo

func NewRuleEngineRepo() *RuleEngineRepo

func (*RuleEngineRepo) GetAppCtx

func (repo *RuleEngineRepo) GetAppCtx() *types.AppContext

func (*RuleEngineRepo) MapScalar

func (repo *RuleEngineRepo) MapScalar(v interface{}) interface{}

MapScalar Implement MapperConfig interface

func (*RuleEngineRepo) Register

func (repo *RuleEngineRepo) Register(f *InternalRule) uint

func (*RuleEngineRepo) RegisterRuleFromString

func (repo *RuleEngineRepo) RegisterRuleFromString(rule string, format string) (uint, error)

func (*RuleEngineRepo) RegisterRulesFromFile

func (repo *RuleEngineRepo) RegisterRulesFromFile(path string) ([]uint, error)

type StringMatcher

type StringMatcher struct {
	// contains filtered or unexported fields
}

func NewStringMatcher

func NewStringMatcher() *StringMatcher

func (*StringMatcher) AddPattern

func (sm *StringMatcher) AddPattern(pattern string, category condition.Operand)

func (*StringMatcher) Build

func (sm *StringMatcher) Build()

func (*StringMatcher) Match

func (sm *StringMatcher) Match(text string) []condition.Operand