Examples with Event org.graylog.events.event.Event used on opensource projects

Example 16 with Event

use of org.graylog.events.event.Event in project graylog2-server by Graylog2.

the class AggregationEventProcessor method eventsFromAggregationResult.

@VisibleForTesting
ImmutableList<EventWithContext> eventsFromAggregationResult(EventFactory eventFactory, AggregationEventProcessorParameters parameters, AggregationResult result) {
    final ImmutableList.Builder<EventWithContext> eventsWithContext = ImmutableList.builder();
    final Set<String> sourceStreams = buildEventSourceStreams(getStreams(parameters), result.sourceStreams());
    for (final AggregationKeyResult keyResult : result.keyResults()) {
        if (!satisfiesConditions(keyResult)) {
            LOG.debug("Skipping result <{}> because the conditions <{}> don't match", keyResult, config.conditions());
            continue;
        }
        final String keyString = Strings.join(keyResult.key(), '|');
        final String eventMessage = createEventMessageString(keyString, keyResult);
        // Extract eventTime from the key result or use query time range as fallback
        final DateTime eventTime = keyResult.timestamp().orElse(result.effectiveTimerange().to());
        final Event event = eventFactory.createEvent(eventDefinition, eventTime, eventMessage);
        // TODO: Do we have to set any other event fields here?
        event.setTimerangeStart(parameters.timerange().getFrom());
        event.setTimerangeEnd(parameters.timerange().getTo());
        sourceStreams.forEach(event::addSourceStream);
        final Map<String, Object> fields = new HashMap<>();
        // username=jane
        for (int i = 0; i < config.groupBy().size(); i++) {
            fields.put(config.groupBy().get(i), keyResult.key().get(i));
        }
        // Group By fields need to be saved on the event so they are available to the subsequent notification events
        event.setGroupByFields(fields.entrySet().stream().collect(Collectors.toMap(Map.Entry::getKey, e -> e.getValue().toString())));
        // aggregation_value_card_anonid=23
        for (AggregationSeriesValue seriesValue : keyResult.seriesValues()) {
            final String function = seriesValue.series().function().toString().toLowerCase(Locale.ROOT);
            final Optional<String> field = seriesValue.series().field();
            final String fieldName;
            if (field.isPresent()) {
                fieldName = String.format(Locale.ROOT, "aggregation_value_%s_%s", function, field.get());
            } else {
                fieldName = String.format(Locale.ROOT, "aggregation_value_%s", function);
            }
            fields.put(fieldName, seriesValue.value());
        }
        // This is the concatenated key value
        fields.put("aggregation_key", keyString);
        // TODO: Can we find a useful source value?
        final Message message = new Message(eventMessage, "", result.effectiveTimerange().to());
        message.addFields(fields);
        LOG.debug("Creating event {}/{} - {} {} ({})", eventDefinition.title(), eventDefinition.id(), keyResult.key(), seriesString(keyResult), fields);
        eventsWithContext.add(EventWithContext.create(event, message));
    }
    return eventsWithContext.build();
}