kelora 1.5.0

A command-line log analysis tool with embedded Rhai scripting
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

use crate::event::Event;
use crate::pipeline::{EventParser, PrefixExtractor};
use anyhow::Result;

/// Wrapper parser that extracts prefix before parsing and adds it to the event
pub struct PrefixExtractingParser {
    inner: Box<dyn EventParser>,
    prefix_extractor: Option<PrefixExtractor>,
}

impl PrefixExtractingParser {
    pub fn new(inner: Box<dyn EventParser>, prefix_extractor: Option<PrefixExtractor>) -> Self {
        Self {
            inner,
            prefix_extractor,
        }
    }
}

impl EventParser for PrefixExtractingParser {
    fn parse(&self, line: &str) -> Result<Event> {
        let (modified_line, extracted_prefix) = if let Some(ref extractor) = self.prefix_extractor {
            extractor.extract_prefix(line)
        } else {
            (line.to_string(), None)
        };

        // Parse the line with the prefix removed
        let mut event = self.inner.parse(&modified_line)?;

        // Add the extracted prefix to the event if we have one
        if let Some(ref extractor) = self.prefix_extractor {
            extractor.add_prefix_to_event(&mut event, extracted_prefix);
        }

        Ok(event)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::parsers::LineParser;

    #[test]
    fn test_prefix_extracting_parser() {
        let base_parser = Box::new(LineParser::new());
        let extractor = PrefixExtractor::new("src".to_string(), "|".to_string());
        let parser = PrefixExtractingParser::new(base_parser, Some(extractor));

        let result = parser.parse("web_1 | Test message").unwrap();

        assert_eq!(
            result
                .fields
                .get("line")
                .unwrap()
                .clone()
                .into_string()
                .unwrap(),
            "Test message"
        );
        assert_eq!(
            result
                .fields
                .get("src")
                .unwrap()
                .clone()
                .into_string()
                .unwrap(),
            "web_1"
        );
    }

    #[test]
    fn test_prefix_extracting_parser_no_prefix() {
        let base_parser = Box::new(LineParser::new());
        let extractor = PrefixExtractor::new("src".to_string(), "|".to_string());
        let parser = PrefixExtractingParser::new(base_parser, Some(extractor));

        let result = parser.parse("Just a normal message").unwrap();

        assert_eq!(
            result
                .fields
                .get("line")
                .unwrap()
                .clone()
                .into_string()
                .unwrap(),
            "Just a normal message"
        );
        assert!(result.fields.get("src").is_none());
    }

    #[test]
    fn test_prefix_extracting_parser_no_extractor() {
        let base_parser = Box::new(LineParser::new());
        let parser = PrefixExtractingParser::new(base_parser, None);

        let result = parser.parse("web_1 | Test message").unwrap();

        assert_eq!(
            result
                .fields
                .get("line")
                .unwrap()
                .clone()
                .into_string()
                .unwrap(),
            "web_1 | Test message"
        );
        assert!(result.fields.get("src").is_none());
    }
}