es4forensics 0.5.1

Import several timelines into elasticsearch
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

use std::collections::{HashMap, HashSet};

use anyhow::bail;
use duplicate::duplicate_item;
use serde_json::{Value, json};

use crate::ecs::ecs_object::EcsObject;
use crate::ecs::{Event, Host, log::Log, File};
use crate::timestamp::Timestamp;

pub struct EcsBuilder {
    ts: Timestamp,
    message: String,
    //labels: HashMap<String, String>,
    tags: HashSet<String>,
    contents: HashMap<&'static str, Value>
}

impl EcsBuilder {

    pub fn new(message: String, ts: Timestamp) -> Self {
        Self {
            ts,
            message,
            tags: HashSet::default(),
            contents: HashMap::default()
        }
    }

    pub fn with_additional_tag(mut self, tag: &str) -> Self {
        self.tags.insert(tag.to_owned());
        self
    }

    #[duplicate_item(
        method       ret_type;
    [ with_event ] [ Event<'_> ];
    [ with_host ]  [ Host ];
    [ with_log ]   [ Log ];
    [ with_file ]  [ File ];
    )]
    pub fn method(mut self, ts: ret_type) -> anyhow::Result<Self> {
        if self.contents.contains_key(ts.object_key()) {
            bail!("unambigious key: '{}'", ts.object_key());
        }
        self.contents.insert(ts.object_key(), json!(ts));
        Ok(self)
    }
}

impl From<EcsBuilder> for (Timestamp, Value) {
    fn from(val: EcsBuilder) -> (Timestamp, Value) {
        let mut m = HashMap::from([
            (
                "@timestamp",
                Value::Number(val.ts.timestamp_millis().into()),
            ),
            ("ecs", json!({"version": "8.4"})),
            ("message", json!(val.message))
        ]);

        if !val.tags.is_empty() {
            m.insert("tags", json!(val.tags));
        }

        for (key, value) in val.contents.into_iter() {
            m.insert(key, value);
        }
        (val.ts, json!(m))

    }
}