ingest

Documentation

Index

• Variables
• type ClearableStore
• type LogOp
  • func NewLogOp(ctx context.Context, store storage.Storage, req api.LogPostRequest) (*LogOp, error)
  • func (p *LogOp) Error() error
  • func (p *LogOp) Stats() api.LogPostStatus
  • func (p *LogOp) Status() <-chan string
• type PcapOp
  • func NewPcapOp(ctx context.Context, pcapstore *pcapstorage.Store, store ClearableStore, ...) (*PcapOp, []string, error)
  • func (p *PcapOp) Done() <-chan struct{}
  • func (p *PcapOp) Err() error
  • func (p *PcapOp) PcapReadSize() int64
  • func (p *PcapOp) Snap() <-chan struct{}
  • func (p *PcapOp) SnapshotCount() int
  • func (p *PcapOp) Write(b []byte) (int, error)

Variables

var (
	ErrNoLogIngestSupport = errors.New("space does not support log ingest")
)

Types

type ClearableStore

type ClearableStore interface {
	storage.Storage
	Clear(ctx context.Context) error
}

type LogOp

type LogOp struct {
	// contains filtered or unexported fields
}

func NewLogOp

func NewLogOp(ctx context.Context, store storage.Storage, req api.LogPostRequest) (*LogOp, error)

Logs ingests the provided list of files into the provided space. Like ingest.Pcap, this overwrites any existing data in the space.

func (*LogOp) Error

func (p *LogOp) Error() error

Error indicates what if any error occurred during import, after the Status channel is closed. The result is undefined while Status is open.

func (*LogOp) Stats

func (p *LogOp) Stats() api.LogPostStatus

func (*LogOp) Status

func (p *LogOp) Status() <-chan string

type PcapOp

type PcapOp struct {
	StartTime nano.Ts
	PcapSize  int64
	// contains filtered or unexported fields
}

func NewPcapOp

func NewPcapOp(ctx context.Context, pcapstore *pcapstorage.Store, store ClearableStore, pcap string, slauncher, zlauncher pcapanalyzer.Launcher) (*PcapOp, []string, error)

NewPcapOp kicks of the process for ingesting a pcap file into a space. Should everything start out successfully, this will return a thread safe Process instance once zeek log files have started to materialize in a tmp directory. If zeekExec is an empty string, this will attempt to resolve zeek from $PATH.

func (*PcapOp) Done

func (p *PcapOp) Done() <-chan struct{}

Done returns a chan that emits when the ingest process is complete.

func (*PcapOp) Err

func (p *PcapOp) Err() error

Err returns the an error if an error occurred while the ingest process was running. If the process is still running Err will wait for the process to complete before returning.

func (*PcapOp) PcapReadSize

func (p *PcapOp) PcapReadSize() int64

PcapReadSize returns the total size in bytes of data read from the underlying pcap file.

func (*PcapOp) Snap

func (p *PcapOp) Snap() <-chan struct{}

Snap returns a chan that emits every time a snapshot is made. It should no longer be read from after Done() has emitted.

func (*PcapOp) SnapshotCount

func (p *PcapOp) SnapshotCount() int

func (*PcapOp) Write

func (p *PcapOp) Write(b []byte) (int, error)