mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-17 07:18:26 +00:00
new(userspace/engine): json event to map type
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
committed by
Leo Di Donato
parent
0565ce2f50
commit
944b46cb67
@@ -796,6 +796,7 @@ std::string json_event_formatter::tostring(json_event *ev)
|
|||||||
std::string json_event_formatter::tojson(json_event *ev)
|
std::string json_event_formatter::tojson(json_event *ev)
|
||||||
{
|
{
|
||||||
nlohmann::json ret;
|
nlohmann::json ret;
|
||||||
|
// todo(leodido, fntlnz) > assign tomap() result to ret (implicit conversion using = operator)
|
||||||
|
|
||||||
std::list<std::pair<std::string, std::string>> resolved;
|
std::list<std::pair<std::string, std::string>> resolved;
|
||||||
|
|
||||||
@@ -806,6 +807,7 @@ std::string json_event_formatter::tojson(json_event *ev)
|
|||||||
// Only include the fields and not the raw text blocks.
|
// Only include the fields and not the raw text blocks.
|
||||||
if(!res.first.empty())
|
if(!res.first.empty())
|
||||||
{
|
{
|
||||||
|
// todo(leodido, fntlnz) > do we want "<NA>" rather than empty res.second values?
|
||||||
ret[res.first] = res.second;
|
ret[res.first] = res.second;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -813,6 +815,29 @@ std::string json_event_formatter::tojson(json_event *ev)
|
|||||||
return ret.dump();
|
return ret.dump();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
std::map<std::string, std::string> json_event_formatter::tomap(json_event *ev)
|
||||||
|
{
|
||||||
|
std::map<std::string, std::string> ret;
|
||||||
|
std::list<std::pair<std::string, std::string>> res;
|
||||||
|
|
||||||
|
resolve_tokens(ev, res);
|
||||||
|
|
||||||
|
for(auto &r : res)
|
||||||
|
{
|
||||||
|
// Only include the fields and not the raw text blocks.
|
||||||
|
if(!r.first.empty())
|
||||||
|
{
|
||||||
|
if(r.second.empty())
|
||||||
|
{
|
||||||
|
r.second = "<NA>";
|
||||||
|
}
|
||||||
|
ret.insert(r);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
void json_event_formatter::parse_format()
|
void json_event_formatter::parse_format()
|
||||||
{
|
{
|
||||||
string tformat = m_format;
|
string tformat = m_format;
|
||||||
|
@@ -287,6 +287,7 @@ public:
|
|||||||
|
|
||||||
std::string tostring(json_event *ev);
|
std::string tostring(json_event *ev);
|
||||||
std::string tojson(json_event *ev);
|
std::string tojson(json_event *ev);
|
||||||
|
std::map<std::string, std::string> tomap(json_event *ev);
|
||||||
|
|
||||||
void resolve_tokens(json_event *ev, std::list<std::pair<std::string,std::string>> &resolved);
|
void resolve_tokens(json_event *ev, std::list<std::pair<std::string,std::string>> &resolved);
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user