Examples with VariableResolver org.apache.metron.stellar.dsl.VariableResolver used on opensource projects

Example 1 with VariableResolver

use of org.apache.metron.stellar.dsl.VariableResolver in project metron by apache.

the class StellarAdapter method enrich.

@Override
public JSONObject enrich(CacheKey value) {
    Context stellarContext = (Context) value.getConfig().getConfiguration().get(STELLAR_CONTEXT_CONF);
    ConfigHandler handler = getHandler.apply(value.getConfig());
    Map<String, Object> globalConfig = value.getConfig().getConfiguration();
    Map<String, Object> sensorConfig = value.getConfig().getEnrichment().getConfig();
    if (handler == null) {
        _LOG.trace("Stellar ConfigHandler is null.");
        return new JSONObject();
    }
    Long slowLogThreshold = null;
    if (_PERF_LOG.isDebugEnabled()) {
        slowLogThreshold = ConversionUtils.convert(globalConfig.getOrDefault(STELLAR_SLOW_LOG, STELLAR_SLOW_LOG_DEFAULT), Long.class);
    }
    // Ensure that you clone the message, because process will modify the message.  If the message object is modified
    // then cache misses will happen because the cache will be modified.
    Map<String, Object> message = new HashMap<>(value.getValue(Map.class));
    VariableResolver resolver = new MapVariableResolver(message, sensorConfig, globalConfig);
    StellarProcessor processor = new StellarProcessor();
    JSONObject enriched = process(message, handler, value.getField(), slowLogThreshold, processor, resolver, stellarContext);
    _LOG.trace("Stellar Enrichment Success: {}", enriched);
    return enriched;
}

Example 2 with VariableResolver

use of org.apache.metron.stellar.dsl.VariableResolver in project metron by apache.

the class HdfsWriter method getHdfsPathExtension.

public String getHdfsPathExtension(String sourceType, String stellarFunction, JSONObject message) {
    // If no function is provided, just use the sourceType directly
    if (stellarFunction == null || stellarFunction.trim().isEmpty()) {
        return sourceType;
    }
    // processor is a StellarProcessor();
    VariableResolver resolver = new MapVariableResolver(message);
    Object objResult = stellarProcessor.parse(stellarFunction, resolver, StellarFunctions.FUNCTION_RESOLVER(), Context.EMPTY_CONTEXT());
    if (objResult != null && !(objResult instanceof String)) {
        throw new IllegalArgumentException("Stellar Function <" + stellarFunction + "> did not return a String value. Returned: " + objResult);
    }
    return objResult == null ? "" : (String) objResult;
}

Example 3 with VariableResolver

use of org.apache.metron.stellar.dsl.VariableResolver in project metron by apache.

the class DefaultStellarStatefulExecutor method execute.

/**
 * Execute a Stellar expression.
 *
 * @param expression     The expression to execute.
 * @param transientState Additional state available to the expression.  This most often represents
 *                       the values available to the expression from an individual message. The state
 *                       maps a variable name to a variable's value.
 */
private Object execute(String expression, Map<String, Object> transientState) {
    VariableResolver variableResolver = new MapVariableResolver(state, transientState);
    StellarProcessor processor = new StellarProcessor();
    return processor.parse(expression, variableResolver, functionResolver, context);
}

Example 4 with VariableResolver

use of org.apache.metron.stellar.dsl.VariableResolver in project metron by apache.

the class LambdaExpression method apply.

public Object apply(List<Object> variableArgs) {
    Map<String, Object> lambdaVariables = new HashMap<>();
    int i = 0;
    for (; i < Math.min(variables.size(), variableArgs.size()); ++i) {
        lambdaVariables.put(variables.get(i), variableArgs.get(i));
    }
    for (; i < variables.size(); ++i) {
        lambdaVariables.put(variables.get(i), null);
    }
    VariableResolver variableResolver = new DefaultVariableResolver(variable -> lambdaVariables.getOrDefault(variable, state.variableResolver.resolve(variable)), variable -> true);
    StellarCompiler.ExpressionState localState = new StellarCompiler.ExpressionState(state.context, state.functionResolver, variableResolver);
    return apply(localState);
}

Example 5 with VariableResolver

use of org.apache.metron.stellar.dsl.VariableResolver in project metron by apache.

the class FixedPcapFilter method test.

@Override
public boolean test(PacketInfo pi) {
    Map<String, Object> fields = packetToFields(pi);
    VariableResolver resolver = new MapVariableResolver(fields);
    String srcAddrIn = (String) resolver.resolve(Constants.Fields.SRC_ADDR.getName());
    Integer srcPortIn = (Integer) resolver.resolve(Constants.Fields.SRC_PORT.getName());
    String dstAddrIn = (String) resolver.resolve(Constants.Fields.DST_ADDR.getName());
    Integer dstPortIn = (Integer) resolver.resolve(Constants.Fields.DST_PORT.getName());
    String protocolIn = "" + resolver.resolve(Constants.Fields.PROTOCOL.getName());
    if (!doHeaderFiltering || testHeader(srcAddrIn, srcPortIn, dstAddrIn, dstPortIn, protocolIn)) {
        // if we don't do header filtering *or* if we have tested the header and decided it's a match
        if (packetFilter != null) {
            // and we have a packet filter, then we need to filter the packet
            byte[] data = (byte[]) resolver.resolve(PcapHelper.PacketFields.PACKET_DATA.getName());
            try {
                return ByteArrayMatchingUtil.INSTANCE.match(packetFilter, data);
            } catch (ExecutionException e) {
                throw new IllegalStateException("Unable to perform binary filter: " + packetFilter + " on " + DatatypeConverter.printHexBinary(data), e);
            }
        } else if (!doHeaderFiltering) {
            // pass the test
            return true;
        } else {
            // and if we *are* doing header filtering and not packet filtering, then we want to pass the test
            return true;
        }
    } else {
        // in this case we're doing header filtering and we failed the header filter test.
        return false;
    }
}