From 9ca4dd24066863a97e12d67afdef85cf0d18cb60 Mon Sep 17 00:00:00 2001 From: Evgeniy Sokolov Date: Sun, 24 Dec 2017 00:50:12 +0100 Subject: [PATCH 1/4] Add support for condition on bool type (#5659) --- CHANGELOG.asciidoc | 1 + libbeat/processors/condition.go | 40 ++++++++++++++++++++-------- libbeat/processors/condition_test.go | 17 +++++++++++- libbeat/processors/config.go | 9 +++++++ libbeat/processors/config_test.go | 10 +++++++ 5 files changed, 65 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index 20e2ded3b2f..df8a3fad490 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -158,6 +158,7 @@ https://github.com/elastic/beats/compare/v6.0.0-beta2...master[Check the HEAD di *Packetbeat* - Configure good defaults for `add_kubernetes_metadata`. {pull}5707[5707] +- Add support for condition on bool type {issue}5659[5659] {pull}5954[5954] *Winlogbeat* diff --git a/libbeat/processors/condition.go b/libbeat/processors/condition.go index 4e8d28b5355..71a912e8b3f 100644 --- a/libbeat/processors/condition.go +++ b/libbeat/processors/condition.go @@ -21,8 +21,9 @@ type RangeValue struct { } type EqualsValue struct { - Int uint64 - Str string + Int uint64 + Str string + Bool bool } type Condition struct { @@ -120,10 +121,17 @@ func (c *Condition) setEquals(cfg *ConditionFields) error { c.equals[field] = EqualsValue{Int: uintValue} } else { sValue, err := extractString(value) - if err != nil { - return err + if err == nil { + c.equals[field] = EqualsValue{Str: sValue} + } else { + bValue, err := extractBool(value) + + if err != nil { + return err + } + + c.equals[field] = EqualsValue{Bool: bValue} } - c.equals[field] = EqualsValue{Str: sValue} } } @@ -259,12 +267,22 @@ func (c *Condition) checkEquals(event ValuesMap) bool { } } else { sValue, err := extractString(value) - if err != nil { - logp.Warn("unexpected type %T in equals condition as it accepts only integers and strings. ", value) - return false - } - if sValue != equalValue.Str { - return false + + if err == nil { + if sValue != equalValue.Str { + return false + } + } else { + bValue, err := extractBool(value) + + if err != nil { + logp.Warn("unexpected type %T in equals condition as it accepts only integers, strings or bools. ", value) + return false + } + + if bValue != equalValue.Bool { + return false + } } } } diff --git a/libbeat/processors/condition_test.go b/libbeat/processors/condition_test.go index 788a3bd3eb8..35bef948b9c 100644 --- a/libbeat/processors/condition_test.go +++ b/libbeat/processors/condition_test.go @@ -93,6 +93,18 @@ func TestEqualsCondition(t *testing.T) { "proc.cpu.total_p.gt": 0.5, }}, }, + + { + Equals: &ConditionFields{fields: map[string]interface{}{ + "final": true, + }}, + }, + + { + Equals: &ConditionFields{fields: map[string]interface{}{ + "final": false, + }}, + }, } conds := GetConditions(t, configs) @@ -115,12 +127,15 @@ func TestEqualsCondition(t *testing.T) { "state": "running", "username": "monica", }, - "type": "process", + "type": "process", + "final": true, }} assert.True(t, conds[0].Check(event)) assert.True(t, conds[1].Check(event)) assert.False(t, conds[2].Check(event)) + assert.True(t, conds[3].Check(event)) + assert.False(t, conds[4].Check(event)) } func TestContainsCondition(t *testing.T) { diff --git a/libbeat/processors/config.go b/libbeat/processors/config.go index 4d59b188d83..a11038acb33 100644 --- a/libbeat/processors/config.go +++ b/libbeat/processors/config.go @@ -130,3 +130,12 @@ func extractString(unk interface{}) (string, error) { return "", fmt.Errorf("unknown type %T passed to extractString", unk) } } + +func extractBool(unk interface{}) (bool, error) { + switch b := unk.(type) { + case bool: + return b, nil + default: + return false, fmt.Errorf("unknown type %T passed to extractBool", unk) + } +} diff --git a/libbeat/processors/config_test.go b/libbeat/processors/config_test.go index 853152184f2..f8eb23c5f52 100644 --- a/libbeat/processors/config_test.go +++ b/libbeat/processors/config_test.go @@ -15,3 +15,13 @@ func TestExtractString(t *testing.T) { } assert.Equal(t, input, v) } + +func TestExtractBool(t *testing.T) { + input := true + + v, err := extractBool(input) + if err != nil { + t.Fatal(err) + } + assert.Equal(t, input, v) +} From 665a1be450c453f9df7e6d22c7303cc1c6b0935c Mon Sep 17 00:00:00 2001 From: Evgeniy Sokolov Date: Sun, 14 Jan 2018 19:36:23 +0100 Subject: [PATCH 2/4] fix tests --- libbeat/processors/condition_test.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/libbeat/processors/condition_test.go b/libbeat/processors/condition_test.go index e2603ae64cc..3eb061cea0e 100644 --- a/libbeat/processors/condition_test.go +++ b/libbeat/processors/condition_test.go @@ -131,16 +131,16 @@ func TestCondition(t *testing.T) { }, { config: ConditionConfig{ - Contains: &ConditionFields{fields: map[string]interface{}{ - "final": true, + Equals: &ConditionFields{fields: map[string]interface{}{ + "final": true, }}, }, result: false, }, { config: ConditionConfig{ - Contains: &ConditionFields{fields: map[string]interface{}{ - "final": false, + Equals: &ConditionFields{fields: map[string]interface{}{ + "final": false, }}, }, result: true, @@ -167,6 +167,7 @@ func TestCondition(t *testing.T) { "keywords": []string{"foo", "bar"}, }, "type": "process", + "final": false, }, } From 7645f81bef6793789fd7aa5061385dac12b32874 Mon Sep 17 00:00:00 2001 From: Evgeniy Sokolov Date: Sun, 14 Jan 2018 19:49:15 +0100 Subject: [PATCH 3/4] less nested if/else --- libbeat/processors/condition.go | 70 ++++++++++++++++------------ libbeat/processors/condition_test.go | 2 +- 2 files changed, 40 insertions(+), 32 deletions(-) diff --git a/libbeat/processors/condition.go b/libbeat/processors/condition.go index 71a912e8b3f..60613298c97 100644 --- a/libbeat/processors/condition.go +++ b/libbeat/processors/condition.go @@ -119,20 +119,22 @@ func (c *Condition) setEquals(cfg *ConditionFields) error { uintValue, err := extractInt(value) if err == nil { c.equals[field] = EqualsValue{Int: uintValue} - } else { - sValue, err := extractString(value) - if err == nil { - c.equals[field] = EqualsValue{Str: sValue} - } else { - bValue, err := extractBool(value) - - if err != nil { - return err - } - - c.equals[field] = EqualsValue{Bool: bValue} - } + continue + } + + sValue, err := extractString(value) + if err == nil { + c.equals[field] = EqualsValue{Str: sValue} + continue + } + + bValue, err := extractBool(value) + if err == nil { + c.equals[field] = EqualsValue{Bool: bValue} + continue } + + return err } return nil @@ -265,26 +267,32 @@ func (c *Condition) checkEquals(event ValuesMap) bool { if intValue != equalValue.Int { return false } - } else { - sValue, err := extractString(value) - - if err == nil { - if sValue != equalValue.Str { - return false - } - } else { - bValue, err := extractBool(value) - - if err != nil { - logp.Warn("unexpected type %T in equals condition as it accepts only integers, strings or bools. ", value) - return false - } - - if bValue != equalValue.Bool { - return false - } + + continue + } + + sValue, err := extractString(value) + + if err == nil { + if sValue != equalValue.Str { + return false + } + + continue + } + + bValue, err := extractBool(value) + + if err == nil { + if bValue != equalValue.Bool { + return false } + + continue } + + logp.Warn("unexpected type %T in equals condition as it accepts only integers, strings or bools. ", value) + return false } return true diff --git a/libbeat/processors/condition_test.go b/libbeat/processors/condition_test.go index 3eb061cea0e..9570228571e 100644 --- a/libbeat/processors/condition_test.go +++ b/libbeat/processors/condition_test.go @@ -166,7 +166,7 @@ func TestCondition(t *testing.T) { "username": "monica", "keywords": []string{"foo", "bar"}, }, - "type": "process", + "type": "process", "final": false, }, } From 72c7eecdc62292d6c63ce515faff92383e056465 Mon Sep 17 00:00:00 2001 From: Evgeniy Sokolov Date: Mon, 22 Jan 2018 21:59:15 +0100 Subject: [PATCH 4/4] review fixes: nl, self error and Err instead Warn --- libbeat/processors/condition.go | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/libbeat/processors/condition.go b/libbeat/processors/condition.go index 60613298c97..fc3e0122eeb 100644 --- a/libbeat/processors/condition.go +++ b/libbeat/processors/condition.go @@ -134,7 +134,7 @@ func (c *Condition) setEquals(cfg *ConditionFields) error { continue } - return err + return fmt.Errorf("unexpected type %T in equals condition", value) } return nil @@ -272,7 +272,6 @@ func (c *Condition) checkEquals(event ValuesMap) bool { } sValue, err := extractString(value) - if err == nil { if sValue != equalValue.Str { return false @@ -282,7 +281,6 @@ func (c *Condition) checkEquals(event ValuesMap) bool { } bValue, err := extractBool(value) - if err == nil { if bValue != equalValue.Bool { return false @@ -291,7 +289,7 @@ func (c *Condition) checkEquals(event ValuesMap) bool { continue } - logp.Warn("unexpected type %T in equals condition as it accepts only integers, strings or bools. ", value) + logp.Err("unexpected type %T in equals condition as it accepts only integers, strings or bools. ", value) return false }