Examples with EventDefinitionDto org.graylog.events.processor.EventDefinitionDto used on opensource projects

Example 21 with EventDefinitionDto

use of org.graylog.events.processor.EventDefinitionDto in project graylog2-server by Graylog2.

the class LegacyAlertConditionMigrator method migrateFieldContentValue.

/**
 * Example field content value alert condition data structure on streams:
 * <pre>{@code
 *         {
 *           "id" : "00000000-0000-0000-0000-000000000001",
 *           "type" : "field_content_value",
 *           "title" : "Field Content - WITHOUT QUERY",
 *           "parameters" : {
 *             "backlog" : 100,
 *             "repeat_notifications" : false,
 *             "field" : "test_field_2",
 *             "query" : "",
 *             "grace" : 2,
 *             "value" : "hello"
 *           },
 *           "creator_user_id" : "admin",
 *           "created_at": "2019-01-01T00:00:00.000Z"
 *         }
 * }</pre>
 */
private void migrateFieldContentValue(Helper helper) {
    final String field = helper.parameters().getString("field");
    final String value = helper.parameters().getString("value");
    // The configured condition query can be empty
    String query = field + ":\"" + value + "\"";
    if (!isNullOrEmpty(helper.query) && !"*".equals(helper.query.trim())) {
        query = query + " AND " + helper.query;
    }
    final String seriesId = helper.newSeriesId();
    final AggregationSeries messageCountSeries = AggregationSeries.builder().id(seriesId).function(AggregationFunction.COUNT).field(null).build();
    final Expr.NumberReference left = Expr.NumberReference.create(seriesId);
    final Expr.NumberValue right = Expr.NumberValue.create(0);
    final Expression<Boolean> expression = Expr.Greater.create(left, right);
    final EventProcessorConfig config = AggregationEventProcessorConfig.builder().streams(ImmutableSet.of(helper.streamId)).query(query).series(ImmutableList.of(messageCountSeries)).groupBy(ImmutableList.of()).conditions(AggregationConditions.builder().expression(expression).build()).searchWithinMs(// The FieldContentValueAlertCondition was just using the alert scanner interval
    executeEveryMs).executeEveryMs(executeEveryMs).build();
    final EventDefinitionDto definitionDto = helper.createEventDefinition(config);
    LOG.info("Migrate legacy field content value alert condition <{}>", definitionDto.title());
    eventDefinitionHandler.create(definitionDto, userService.getRootUser());
}

Example 22 with EventDefinitionDto

use of org.graylog.events.processor.EventDefinitionDto in project graylog2-server by Graylog2.

the class LegacyAlertConditionMigrator method migrateMessageCount.

/**
 * Example message count alert condition data structure on streams:
 * <pre>{@code
 *         {
 *           "id" : "00000000-0000-0000-0000-000000000001",
 *           "type" : "message_count",
 *           "title" : "Message Count - MORE",
 *           "parameters" : {
 *             "backlog" : 10,
 *             "repeat_notifications" : false,
 *             "query" : "hello:world",
 *             "grace" : 2,
 *             "threshold_type" : "MORE",
 *             "threshold" : 1,
 *             "time" : 10
 *           },
 *           "creator_user_id" : "admin",
 *           "created_at": "2019-01-01T00:00:00.000Z"
 *         }
 * }</pre>
 */
private void migrateMessageCount(Helper helper) {
    final String seriesId = helper.newSeriesId();
    final AggregationSeries messageCountSeries = AggregationSeries.builder().id(seriesId).function(AggregationFunction.COUNT).field(null).build();
    final Expression<Boolean> expression = helper.createExpression(seriesId, "MORE");
    final EventProcessorConfig config = helper.createAggregationProcessorConfig(messageCountSeries, expression, executeEveryMs);
    final EventDefinitionDto definitionDto = helper.createEventDefinition(config);
    LOG.info("Migrate legacy message count alert condition <{}>", definitionDto.title());
    eventDefinitionHandler.create(definitionDto, userService.getRootUser());
}

Example 23 with EventDefinitionDto

use of org.graylog.events.processor.EventDefinitionDto in project graylog2-server by Graylog2.

the class EventDefinitionFacade method resolveNativeEntity.

@Override
public Graph<EntityDescriptor> resolveNativeEntity(EntityDescriptor entityDescriptor) {
    final MutableGraph<EntityDescriptor> mutableGraph = GraphBuilder.directed().build();
    mutableGraph.addNode(entityDescriptor);
    final ModelId modelId = entityDescriptor.id();
    final Optional<EventDefinitionDto> eventDefinition = eventDefinitionService.get(modelId.id());
    if (eventDefinition.isPresent()) {
        eventDefinition.get().resolveNativeEntity(entityDescriptor, mutableGraph);
    } else {
        LOG.debug("Couldn't find event definition {}", entityDescriptor);
    }
    return ImmutableGraph.copyOf(mutableGraph);
}

Example 24 with EventDefinitionDto

use of org.graylog.events.processor.EventDefinitionDto in project graylog2-server by Graylog2.

the class EventDefinitionFacade method decode.

private NativeEntity<EventDefinitionDto> decode(EntityV1 entity, Map<String, ValueReference> parameters, Map<EntityDescriptor, Object> nativeEntities, User user) {
    final EventDefinitionEntity eventDefinitionEntity = objectMapper.convertValue(entity.data(), EventDefinitionEntity.class);
    final EventDefinitionDto eventDefinition = eventDefinitionEntity.toNativeEntity(parameters, nativeEntities);
    final EventDefinitionDto savedDto;
    if (eventDefinitionEntity.isScheduled().asBoolean(parameters)) {
        savedDto = eventDefinitionHandler.create(eventDefinition, Optional.ofNullable(user));
    } else {
        savedDto = eventDefinitionHandler.createWithoutSchedule(eventDefinition, Optional.ofNullable(user));
    }
    return NativeEntity.create(entity.id(), savedDto.id(), ModelTypes.EVENT_DEFINITION_V1, savedDto.title(), savedDto);
}

Example 25 with EventDefinitionDto

use of org.graylog.events.processor.EventDefinitionDto in project graylog2-server by Graylog2.

the class EventDefinitionsResource method create.

@POST
@Produces(MediaType.APPLICATION_JSON)
@ApiOperation("Create new event definition")
@AuditEvent(type = EventsAuditEventTypes.EVENT_DEFINITION_CREATE)
@RequiresPermissions(RestPermissions.EVENT_DEFINITIONS_CREATE)
public Response create(@ApiParam("schedule") @QueryParam("schedule") @DefaultValue("true") boolean schedule, @ApiParam(name = "JSON Body") EventDefinitionDto dto, @Context UserContext userContext) {
    checkEventDefinitionPermissions(dto, "create");
    final ValidationResult result = dto.validate();
    if (result.failed()) {
        return Response.status(Response.Status.BAD_REQUEST).entity(result).build();
    }
    final EventDefinitionDto entity = schedule ? eventDefinitionHandler.create(dto, Optional.of(userContext.getUser())) : eventDefinitionHandler.createWithoutSchedule(dto, Optional.of(userContext.getUser()));
    return Response.ok().entity(entity).build();
}