Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

make size of topk-list configureable when using sumstats

Browse source
This commit is contained in:
Bernhard Amann 2013-04-24 15:01:06 -07:00
parent 2f48008c42
commit c0890f2a0f
3 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/base/frameworks/sumstats/plugins/topk.bro
View file

@ -3,16 +3,27 @@
module SumStats; module SumStats;
export { export {
redef record Reducer += {
## number of elements to keep in the top-k list
topk_size: count &default=500;
};
redef enum Calculation += { redef enum Calculation += {
TOPK TOPK
}; };
redef record ResultVal += { redef record ResultVal += {
topk: opaque of topk &default=topk_init(500); topk: opaque of topk &optional;
}; };
} }
hook init_resultval_hook(r: Reducer, rv: ResultVal)
{
if ( TOPK in r$apply && ! rv?$topk )
rv$topk = topk_init(r$topk_size);
}
hook observe_hook(r: Reducer, val: double, obs: Observation, rv: ResultVal) hook observe_hook(r: Reducer, val: double, obs: Observation, rv: ResultVal)
{ {
if ( TOPK in r$apply ) if ( TOPK in r$apply )
@ -24,7 +35,7 @@ hook observe_hook(r: Reducer, val: double, obs: Observation, rv: ResultVal)
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal) hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{ {
result$topk = topk_init(500); result$topk = topk_init(topk_size(rv1$topk));
topk_merge(result$topk, rv1$topk); topk_merge(result$topk, rv1$topk);
topk_merge(result$topk, rv2$topk); topk_merge(result$topk, rv2$topk);

1
src/Topk.h
View file

@ -40,6 +40,7 @@ public:
VectorVal* getTopK(int k) const; // returns vector VectorVal* getTopK(int k) const; // returns vector
uint64_t getCount(Val* value) const; uint64_t getCount(Val* value) const;
uint64_t getEpsilon(Val* value) const; uint64_t getEpsilon(Val* value) const;
uint64_t getSize() const { return size; }
void Merge(const TopkVal* value); void Merge(const TopkVal* value);
protected: protected:

7
src/bro.bif
View file

@ -5684,6 +5684,13 @@ function topk_epsilon%(handle: opaque of topk, value: any%): count
return new Val(h->getEpsilon(value), TYPE_COUNT); return new Val(h->getEpsilon(value), TYPE_COUNT);
%} %}
function topk_size%(handle: opaque of topk%): count
%{
assert(handle);
Topk::TopkVal* h = (Topk::TopkVal*) handle;
return new Val(h->getSize(), TYPE_COUNT);
%}
function topk_merge%(handle1: opaque of topk, handle2: opaque of topk%): any function topk_merge%(handle1: opaque of topk, handle2: opaque of topk%): any
%{ %{
assert(handle1); assert(handle1);