Skip to content

[Agent] Rule extracting items from array#15809

Merged
michalpristas merged 4 commits intoelastic:fleetfrom
michalpristas:extract-list-item
Jan 28, 2020
Merged

[Agent] Rule extracting items from array#15809
michalpristas merged 4 commits intoelastic:fleetfrom
michalpristas:extract-list-item

Conversation

@michalpristas
Copy link
Copy Markdown
Contributor

@michalpristas michalpristas commented Jan 24, 2020

ExtractListItemRule extract items with specified name from a list of maps.
The result is store in a new array.

Example:
Source:

streams:
  - name: MySQL error log
    input:
      type:	file
      path:	/var/log/mysql/error.log
  - name: MySQL access log
    input:
      type:	file
      path:	/var/log/mysql/access.log
  - name: MySQL metrics
    input:
      type: mysql
      host: localhost
      port: 3306

Called

ExtractList("streams", "input", "inputs")

For extracting input fields from streams list and storing it in new list named inputs

result:

streams:
  - name: MySQL error log
    input:
      type:	file
      path:	/var/log/mysql/error.log
  - name: MySQL access log
    input:
      type:	file
      path: /var/log/mysql/access.log
  - name: MySQL metrics
    input:
      type: mysql
      host: localhost
      port: 3306
inputs:
  - type: file
    path: /var/log/mysql/error.log
  - type: file
    path: /var/log/mysql/access.log
  - type: mysql
    host: localhost
    port: 3306

cc #15690

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/ingest (Project:fleet)

Comment thread x-pack/agent/pkg/agent/transpiler/rules.go
Copy link
Copy Markdown
Contributor

@ph ph left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a small suggestion.

r = &ExtractListItemRule{}
if err := unpack(fields, r); err != nil {
return err
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looking at the method, its a problem with all the cases statement of the switch case, we could do:

Suggested change
}
return unpack(fields, r)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we cant return just but i will change it to less chatty way

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants