helpers

Documentation

Index

• func BuildFilterMap(filterString []string) (map[string]*filter.SqlFilter, error)
• func ExtractNamedGroupsFromGrok(grokPattern string) []string
• func GetGranularityFromFileLayout(fileLayout *string) time.Duration

Functions

func BuildFilterMap

func BuildFilterMap(filterString []string) (map[string]*filter.SqlFilter, error)

BuildFilterMap parses the provided filter strings and returns a map of field name to SQL filters. Note: this will fail if any filter refers to more than one field

func ExtractNamedGroupsFromGrok

func ExtractNamedGroupsFromGrok(grokPattern string) []string

ExtractNamedGroupsFromGrok extracts named groups from a Grok pattern

func GetGranularityFromFileLayout

func GetGranularityFromFileLayout(fileLayout *string) time.Duration

GetGranularityFromFileLayout is a helper function to determine the granularity of the collection state based on the file layout

the 'granularity' means what it the shortest period we can determine that an artifact comes from based on its filename e.g., if the filename contains {year}/{month}/{day}/{hour}/{minute}, the granularity is 1 minute if the filename contains {year}/{month}/{day}/{hour}, the granularity is 1 hour NOTE: we traverse the time properties from largest to smallest