filter

Documentation

Overview

Copyright (c) Tobias Schäfer. All rights reserved. Licensed under the MIT License, see LICENSE file in the project root for details.

Index

• type Filter
  • func NewFilter(ruleStrings []string) (*Filter, error)
  • func (f *Filter) Evaluate(event conntrack.Event) (bool, bool, int)

Types

type Filter

type Filter struct {
	// contains filtered or unexported fields
}

Filter represents a CEL-based filter

func NewFilter

func NewFilter(ruleStrings []string) (*Filter, error)

NewFilter creates a new CEL-based filter from rule strings

func (*Filter) Evaluate

func (f *Filter) Evaluate(event conntrack.Event) (bool, bool, int)

Evaluate evaluates the filter against an event Returns: (matched bool, shouldLog bool, matchedRuleIndex int) If no rule matches, returns (false, true, -1) for log-by-default policy