Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 05:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Final changes to log framework ext code.

Browse source 
The "metadata" functionality has been renamed to "ext" to
represent that the logs are being extended.  The function that
returns the record which is used to extend the log now receives
a log filter as it's single argument.

The field name "unrolling" is now renamed to "scope" so the variables
names now look like this: "Log::default_scope_sep"
This commit is contained in:
Seth Hall 2016-08-10 12:43:32 -04:00
parent a60ce35103
commit 5f6565d62c
4 changed files with 92 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

57
scripts/base/frameworks/logging/main.bro
View file

@ -117,19 +117,11 @@ export {
## data storage and analysis systems.
const default_field_name_map: table[string] of string = table() &redef;
## Default separator for unrolled and flattened fields names for
## nested records.
const default_unrolling_sep = "." &redef;
## A prefix for metadata fields which can be optionally prefixed
## on all log lines by setting the `metadata_func` field in the
## log filter.
const Log::default_metadata_prefix: string = "_" &redef;
## Default metadata function in the case that you would like to
## apply the same metadata to all logs. The function *must* return
## a record with all of the fields to be included in the metadata.
const Log::default_metadata_func: function(path: string): any &redef;
## Default separator for log field scopes when logs are unrolled and
## flattened. This will be the string between field name components.
## For example, setting this to "_" will cause the typical field
## "id.orig_h" to turn into "id_orig_h".
const default_scope_sep = "." &redef;
## A filter type describes how to customize logging streams.
type Filter: record {
@ -211,21 +203,11 @@ export {
## A string that is used for unrolling and flattening field names
## for nested record types.
unrolling_sep: string &default=default_unrolling_sep;
scope_sep: string &default=default_scope_sep;
## Rotation interval. Zero disables rotation.
interv: interval &default=default_rotation_interval;
## Default prefix for all metadata fields. It's typically
## prudent to set this to something that Bro's logging
## framework can't normally write out in a field name.
metadata_prefix: string &default="_";
## Function to collect a metadata value. If not specified, no
## metadata will be provided for the log.
## The return value from the function *must* be a record.
metadata_func: function(path: string): any &optional;
## Callback function to trigger for rotated files. If not set, the
## default comes out of :bro:id:`Log::default_rotation_postprocessors`.
postprocessor: function(info: RotationInfo) : bool &optional;
@ -236,6 +218,33 @@ export {
config: table[string] of string &default=table();
};
## A prefix for extension fields which can be optionally prefixed
## on all log lines by setting the `ext_func` field in the
## log filter.
const Log::default_ext_prefix: string = "_" &redef;
## Default log extension function in the case that you would like to
## apply the same extensions to all logs. The function *must* return
## a record with all of the fields to be included in the log. The
## default function included here returns F as a marker to indicate
## that it has no implementation.
const Log::default_ext_func: function(filter: Log::Filter): any =
function(filter: Log::Filter): bool { return F; } &redef;
# This is a hack for now since fields can't self-reference the
# record type they are contained within.
redef record Log::Filter += {
## Default prefix for all extension fields. It's typically
## prudent to set this to something that Bro's logging
## framework can't normally write out in a field name.
ext_prefix: string &default=Log::default_ext_prefix;
## Function to collect a log extension value. If not specified,
## no log extension will be provided for the log.
## The return value from the function *must* be a record.
ext_func: function(filter: Log::Filter): any &default=Log::default_ext_func;
};
## Sentinel value for indicating that a filter was not found when looked up.
const no_filter: Filter = [$name="<not found>"];