fail2ban-log-parser-core 0.1.2

Fast, zero-copy fail2ban log parser built with winnow
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

use winnow::{
    Parser,
    ascii::Caseless,
    combinator::{alt, opt},
    error::StrContext,
};

#[derive(Debug, Clone, PartialEq)]
#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
pub enum Fail2BanEvent {
    Found,
    Ban,
    Unban,
    Restore,
    Ignore,
    AlreadyBanned,
    Failed,
    Unknown,
}

impl std::fmt::Display for Fail2BanEvent {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::Found => write!(f, "Found"),
            Self::Ban => write!(f, "Ban"),
            Self::Unban => write!(f, "Unban"),
            Self::Restore => write!(f, "Restore"),
            Self::Ignore => write!(f, "Ignore"),
            Self::AlreadyBanned => write!(f, "AlreadyBanned"),
            Self::Failed => write!(f, "Failed"),
            Self::Unknown => write!(f, "Unknown"),
        }
    }
}

pub(super) fn parse_event(input: &mut &str) -> winnow::Result<Option<Fail2BanEvent>> {
    opt(alt((
        Caseless("found").value(Fail2BanEvent::Found),
        Caseless("ban").value(Fail2BanEvent::Ban),
        Caseless("unban").value(Fail2BanEvent::Unban),
        Caseless("restore").value(Fail2BanEvent::Restore),
        Caseless("ignore").value(Fail2BanEvent::Ignore),
        Caseless("alreadybanned").value(Fail2BanEvent::AlreadyBanned),
        Caseless("failed").value(Fail2BanEvent::Failed),
        Caseless("unknown").value(Fail2BanEvent::Unknown),
    ))
    .context(StrContext::Label(
        "valid log level (info, notice, warning, error, or debug)",
    )))
    .parse_next(input)
}