|
@@ -725,53 +725,52 @@ func ExtRuleCoreByReg(extfrom string, doc map[string]interface{}, j *ju.Job, in
|
|
|
//lua脚本根据属性设置提取kv值
|
|
|
func getKvByLuaFields(vc *RuleCore, j *ju.Job, et *ExtractTask) map[string][]map[string]interface{} {
|
|
|
kvmap := map[string][]map[string]interface{}{}
|
|
|
- blocks := []*ju.Block{}
|
|
|
- for _, bl := range j.Block {
|
|
|
- if len(bl.Block) > 0 {
|
|
|
- blocks = append(blocks, bl.Block...)
|
|
|
- } else {
|
|
|
- blocks = append(blocks, bl)
|
|
|
- }
|
|
|
- }
|
|
|
for fieldname, field := range vc.LFields {
|
|
|
if field != vc.Field {
|
|
|
continue
|
|
|
}
|
|
|
- for _, bl := range blocks {
|
|
|
- tp := ""
|
|
|
- for k, v := range []*ju.JobKv{bl.ColonKV, bl.SpaceKV, bl.TableKV} {
|
|
|
- if k == 0 {
|
|
|
- tp = "colon"
|
|
|
- } else if k == 1 {
|
|
|
- tp = "space"
|
|
|
- } else if k == 2 {
|
|
|
- tp = "table"
|
|
|
- }
|
|
|
- if v == nil || v.KvTags == nil {
|
|
|
- continue
|
|
|
- }
|
|
|
- for _, vv := range v.KvTags[fieldname] {
|
|
|
- text := ju.TrimLRSpace(vv.Value, "")
|
|
|
- if text != "" {
|
|
|
- kvmap[field] = append(kvmap[field], map[string]interface{}{
|
|
|
- "code": "CL_" + vv.Key,
|
|
|
- "field": field,
|
|
|
- "ruletext": vv.Key,
|
|
|
- "extfrom": vc.ExtFrom,
|
|
|
- "sourcevalue": text,
|
|
|
- "value": text,
|
|
|
- "type": tp,
|
|
|
- "matchtype": "tag_string",
|
|
|
- "blocktag": bl.Classify,
|
|
|
- "weight": vv.Weight,
|
|
|
- })
|
|
|
- }
|
|
|
+ extractFromKv(field, fieldname, j.Block, vc, kvmap)
|
|
|
+ }
|
|
|
+ AddExtLog("extract", j.SourceMid, nil, kvmap, &RegLuaInfo{Field: vc.Field}, et.TaskInfo) //抽取日志
|
|
|
+ return kvmap
|
|
|
+}
|
|
|
+
|
|
|
+func extractFromKv(field, fieldname string, blocks []*ju.Block, vc *RuleCore, kvmap map[string][]map[string]interface{}) {
|
|
|
+ for _, bl := range blocks {
|
|
|
+ tp := ""
|
|
|
+ for k, v := range []*ju.JobKv{bl.ColonKV, bl.SpaceKV, bl.TableKV} {
|
|
|
+ if k == 0 {
|
|
|
+ tp = "colon"
|
|
|
+ } else if k == 1 {
|
|
|
+ tp = "space"
|
|
|
+ } else if k == 2 {
|
|
|
+ tp = "table"
|
|
|
+ }
|
|
|
+ if v == nil || v.KvTags == nil {
|
|
|
+ continue
|
|
|
+ }
|
|
|
+ for _, vv := range v.KvTags[fieldname] {
|
|
|
+ text := ju.TrimLRSpace(vv.Value, "")
|
|
|
+ if text != "" {
|
|
|
+ kvmap[field] = append(kvmap[field], map[string]interface{}{
|
|
|
+ "code": "CL_" + vv.Key,
|
|
|
+ "field": field,
|
|
|
+ "ruletext": vv.Key,
|
|
|
+ "extfrom": vc.ExtFrom,
|
|
|
+ "sourcevalue": text,
|
|
|
+ "value": text,
|
|
|
+ "type": tp,
|
|
|
+ "matchtype": "tag_string",
|
|
|
+ "blocktag": bl.Classify,
|
|
|
+ "weight": vv.Weight,
|
|
|
+ })
|
|
|
}
|
|
|
}
|
|
|
}
|
|
|
+ if len(kvmap[field]) == 0 {
|
|
|
+ extractFromKv(field, fieldname, bl.Block, vc, kvmap)
|
|
|
+ }
|
|
|
}
|
|
|
- AddExtLog("extract", j.SourceMid, nil, kvmap, &RegLuaInfo{Field: vc.Field}, et.TaskInfo) //抽取日志
|
|
|
- return kvmap
|
|
|
}
|
|
|
|
|
|
//正则提取结果
|