diff --git a/lib/events/athena/athena.go b/lib/events/athena/athena.go index 888bdfded3616..3d2ef0389c53f 100644 --- a/lib/events/athena/athena.go +++ b/lib/events/athena/athena.go @@ -398,11 +398,11 @@ func (l *Log) EmitAuditEvent(ctx context.Context, in apievents.AuditEvent) error } func (l *Log) SearchEvents(ctx context.Context, req events.SearchEventsRequest) ([]apievents.AuditEvent, string, error) { - return l.querier.SearchEvents(ctx, req.From, req.To, req.EventTypes, req.Limit, req.Order, req.StartKey) + return l.querier.SearchEvents(ctx, req) } func (l *Log) SearchSessionEvents(ctx context.Context, req events.SearchSessionEventsRequest) ([]apievents.AuditEvent, string, error) { - return l.querier.SearchSessionEvents(ctx, req.From, req.To, req.Limit, req.Order, req.StartKey, req.Cond, req.SessionID) + return l.querier.SearchSessionEvents(ctx, req) } func (l *Log) Close() error { diff --git a/lib/events/athena/querier.go b/lib/events/athena/querier.go index 0b0660986e2c6..7a96494fb15c3 100644 --- a/lib/events/athena/querier.go +++ b/lib/events/athena/querier.go @@ -113,43 +113,39 @@ func newQuerier(cfg querierConfig) (*querier, error) { }, nil } -func (q *querier) SearchEvents(ctx context.Context, fromUTC, toUTC time.Time, - eventTypes []string, limit int, order types.EventOrder, startKey string, -) ([]apievents.AuditEvent, string, error) { - filter := searchEventsFilter{eventTypes: eventTypes} +func (q *querier) SearchEvents(ctx context.Context, req events.SearchEventsRequest) ([]apievents.AuditEvent, string, error) { + filter := searchEventsFilter{eventTypes: req.EventTypes} events, keyset, err := q.searchEvents(ctx, searchEventsRequest{ - fromUTC: fromUTC, - toUTC: toUTC, - limit: limit, - order: order, - startKey: startKey, + fromUTC: req.From.UTC(), + toUTC: req.To.UTC(), + limit: req.Limit, + order: req.Order, + startKey: req.StartKey, filter: filter, sessionID: "", }) return events, keyset, trace.Wrap(err) } -func (q *querier) SearchSessionEvents(ctx context.Context, fromUTC, toUTC time.Time, limit int, - order types.EventOrder, startKey string, cond *types.WhereExpr, sessionID string, -) ([]apievents.AuditEvent, string, error) { +func (q *querier) SearchSessionEvents(ctx context.Context, req events.SearchSessionEventsRequest) ([]apievents.AuditEvent, string, error) { // TODO(tobiaszheller): maybe if fromUTC is 0000-00-00, ask first last 30days and fallback to -inf - now-30 // for sessionID != "". This kind of call is done on RBAC to check if user can access that session. filter := searchEventsFilter{eventTypes: []string{events.SessionEndEvent, events.WindowsDesktopSessionEndEvent}} - if cond != nil { - condFn, err := utils.ToFieldsCondition(cond) + if req.Cond != nil { + condFn, err := utils.ToFieldsCondition(req.Cond) if err != nil { return nil, "", trace.Wrap(err) } filter.condition = condFn } events, keyset, err := q.searchEvents(ctx, searchEventsRequest{ - fromUTC: fromUTC, - toUTC: toUTC, - limit: limit, - order: order, - startKey: startKey, + fromUTC: req.From.UTC(), + toUTC: req.To.UTC(), + limit: req.Limit, + order: req.Order, + startKey: req.StartKey, filter: filter, - sessionID: sessionID, + sessionID: req.SessionID, }) return events, keyset, trace.Wrap(err) }