Examples with CEFParser com.github.jcustenborder.cef.CEFParser used on opensource projects

Example 1 with CEFParser

use of com.github.jcustenborder.cef.CEFParser in project graylog2-server by Graylog2.

the class CEFParserFunction method evaluate.

@Override
public CEFParserResult evaluate(FunctionArgs args, EvaluationContext context) {
    final String cef = valueParam.required(args, context);
    final boolean useFullNames = useFullNamesParam.optional(args, context).orElse(false);
    final CEFParser parser = CEFParserFactory.create();
    if (cef == null || cef.isEmpty()) {
        LOG.debug("NULL or empty parameter passed to CEF parser function. Not evaluating.");
        return null;
    }
    LOG.debug("Running CEF parser for [{}].", cef);
    final MappedMessage message;
    try (Timer.Context timer = parseTime.time()) {
        message = new MappedMessage(parser.parse(cef.trim()), useFullNames);
    } catch (Exception e) {
        LOG.error("Error while parsing CEF message: {}", cef, e);
        return null;
    }
    final Map<String, Object> fields = new HashMap<>();
    /*
          * Add all CEF standard fields. We are prefixing with cef_ to avoid overwriting existing fields or to be
          * overwritten ourselves later in the processing. The user is encouraged to run another pipeline function
          * to clean up field names if desired.
         */
    fields.put("cef_version", message.cefVersion());
    fields.put("device_vendor", message.deviceVendor());
    fields.put("device_product", message.deviceProduct());
    fields.put("device_version", message.deviceVersion());
    fields.put("device_event_class_id", message.deviceEventClassId());
    fields.put("name", message.name());
    fields.put("severity", message.severity());
    // Add all custom CEF fields.
    fields.putAll(message.mappedExtensions());
    return new CEFParserResult(fields);
}