made the pipeline to parse json logs

This commit is contained in:
Hari Krishna
2024-06-21 10:28:49 +00:00
committed by satti-hari-krishna-reddy
parent 3595881a34
commit ad92e5e722
2 changed files with 27 additions and 39 deletions
+11 -28
View File
@@ -2065,8 +2065,8 @@ func handlePipelineCallback(resp http.ResponseWriter, request *http.Request) {
resp.Write([]byte(`{"success": false}`)) resp.Write([]byte(`{"success": false}`))
return return
} }
// fix this
parsedBody, err := string(jsonList) parsedBody, err := json.Marshal(jsonList)
if err != nil { if err != nil {
log.Printf("[ERROR] Failed to marshal jsonList: %s", err) log.Printf("[ERROR] Failed to marshal jsonList: %s", err)
resp.WriteHeader(500) resp.WriteHeader(500)
@@ -2077,7 +2077,7 @@ func handlePipelineCallback(resp http.ResponseWriter, request *http.Request) {
newBody := shuffle.ExecutionStruct{ newBody := shuffle.ExecutionStruct{
Start: pipeline.StartNode, Start: pipeline.StartNode,
ExecutionSource: "pipeline", ExecutionSource: "pipeline",
ExecutionArgument: parsedBody, ExecutionArgument: string(parsedBody),
} }
workflow, err := shuffle.GetWorkflow(ctx, pipeline.WorkflowId) workflow, err := shuffle.GetWorkflow(ctx, pipeline.WorkflowId)
@@ -2131,41 +2131,24 @@ func handlePipelineCallback(resp http.ResponseWriter, request *http.Request) {
func parseConcatenatedJSONLogs(logs string) ([]map[string]interface{}, error) { func parseConcatenatedJSONLogs(logs string) ([]map[string]interface{}, error) {
var jsonList []map[string]interface{} var jsonList []map[string]interface{}
var currentObject []rune decoder := json.NewDecoder(strings.NewReader(logs))
var depth int
for _, char := range logs { for decoder.More() {
if char == '{' {
depth++
}
if char == '}' {
depth--
}
currentObject = append(currentObject, char)
// When depth is 0, it means we have a complete JSON object but will this work ??
if depth == 0 && len(currentObject) > 0 {
var jsonObject map[string]interface{} var jsonObject map[string]interface{}
err := json.Unmarshal([]byte(string(currentObject)), &jsonObject) if err := decoder.Decode(&jsonObject); err != nil {
if err != nil { log.Printf("[WARNING] JSON decoding error: %s. Skipping this object.", err)
log.Printf("[WARNING] JSON unmarshal error: %s. Skipping this object.", err) continue
} else { }
jsonList = append(jsonList, jsonObject) jsonList = append(jsonList, jsonObject)
} }
currentObject = nil
}
}
currentObject = []rune(strings.TrimSpace(string(currentObject))) if err := decoder.Decode(&struct{}{}); err != io.EOF {
if len(currentObject) > 0 { return nil, fmt.Errorf("error after decoding all JSON objects: %v", err)
log.Printf("[WARNING] Incomplete JSON object found: %s. Skipping this object.", string(currentObject))
} }
return jsonList, nil return jsonList, nil
} }
func executeCloudAction(action shuffle.CloudSyncJob, apikey string) error { func executeCloudAction(action shuffle.CloudSyncJob, apikey string) error {
data, err := json.Marshal(action) data, err := json.Marshal(action)
if err != nil { if err != nil {
+10 -5
View File
@@ -2462,7 +2462,7 @@ func handlePipeline(incRequest shuffle.ExecutionRequest) error {
log.Printf("[ERROR] Failed searching for Pipeline with name %s reason:%s ", identifier, err) log.Printf("[ERROR] Failed searching for Pipeline with name %s reason:%s ", identifier, err)
return err return err
} }
_, err = updatePipelineState(pipelineId, "stop") _, err = updatePipelineState(command, pipelineId, "stop")
if err != nil { if err != nil {
log.Printf("[ERROR] Failed to stop Pipeline: %s reason:%s ", pipelineId, err) log.Printf("[ERROR] Failed to stop Pipeline: %s reason:%s ", pipelineId, err)
return err return err
@@ -2482,7 +2482,7 @@ func handlePipeline(incRequest shuffle.ExecutionRequest) error {
log.Printf("[ERROR] Failed searching for Pipeline with name %s reason:%s ", identifier, err) log.Printf("[ERROR] Failed searching for Pipeline with name %s reason:%s ", identifier, err)
return err return err
} }
_, err = updatePipelineState(pipelineId, "start") _, err = updatePipelineState(command, pipelineId, "start")
if err != nil { if err != nil {
log.Printf("[ERROR] Failed to start Pipeline: %s reason:%s ", pipelineId, err) log.Printf("[ERROR] Failed to start Pipeline: %s reason:%s ", pipelineId, err)
return err return err
@@ -2689,7 +2689,11 @@ func createPipeline(command, identifier string) (string, error) {
// } // }
// } // }
command = "from file /var/lib/tenzir/sysmon_logs.ndjson read json | sigma /var/lib/tenzir/rule.yaml | to https://shuffler.io/api/v1/hooks/webhook_d295c43a-e322-4afc-9a59-af167ae7c190" //command = "from file /var/lib/tenzir/sysmon_logs.ndjson read json | sigma /var/lib/tenzir/rule.yaml"
//command = "from file /var/lib/tenzir/sysmon_logs.ndjson read json | import"
//command = "export | to https://expert-acorn-v6vg4j4j5w7q2wg6g-5001.app.github.dev/api/v1/hooks/webhook_623eab3f-0af4-4d40-abb9-699d9a493411"
log.Printf("[HARI] this is the command %s", command)
requestBody := map[string]interface{}{ requestBody := map[string]interface{}{
"definition": command, "definition": command,
"name": identifier, "name": identifier,
@@ -2697,7 +2701,7 @@ func createPipeline(command, identifier string) (string, error) {
"autostart": map[string]bool{ "autostart": map[string]bool{
"created": true, "created": true,
"completed": false, "completed": false,
"failed": true, "failed": false,
}, },
"autodelete": map[string]bool{ "autodelete": map[string]bool{
"completed": false, "completed": false,
@@ -2763,13 +2767,14 @@ func createPipeline(command, identifier string) (string, error) {
return id, nil return id, nil
} }
func updatePipelineState(pipelineId, action string) (string, error) { func updatePipelineState(command, pipelineId, action string) (string, error) {
url := fmt.Sprintf("%s/api/v0/pipeline/update", tenzirUrl) url := fmt.Sprintf("%s/api/v0/pipeline/update", tenzirUrl)
forwardMethod := "POST" forwardMethod := "POST"
requestBody := map[string]interface{}{ requestBody := map[string]interface{}{
"id": pipelineId, "id": pipelineId,
"definition": command,
"action": action, "action": action,
"autostart": map[string]bool{ "autostart": map[string]bool{
"created": true, "created": true,