1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <tcutil.h>
#include "grok_input.h"
#include "grok_config.h"
#include "grok_matchconf.h"
#include "grok_logging.h"
void conf_init(struct config *conf) {
conf->nprograms = 0;
conf->program_size = 10;
conf->programs = calloc(conf->program_size, sizeof(grok_pattern_t));
conf->logmask = 0;
conf->logdepth = 0;
}
void conf_new_program(struct config *conf) {
/* TODO(sissel): put most of this into grok_program_init, or something */
conf->nprograms++;
if (conf->nprograms == conf->program_size) {
conf->program_size *= 2;
conf->programs = realloc(conf->programs,
conf->program_size * sizeof(grok_pattern_t));
}
CURPROGRAM.ninputs = 0;
CURPROGRAM.input_size = 10;
CURPROGRAM.inputs = calloc(CURPROGRAM.input_size, sizeof(grok_input_t));
CURPROGRAM.nmatchconfigs = 0;
CURPROGRAM.matchconfig_size = 10;
CURPROGRAM.matchconfigs = calloc(CURPROGRAM.matchconfig_size,
sizeof(grok_matchconf_t));
CURPROGRAM.npatternfiles = 0;
CURPROGRAM.patternfile_size = 10;
CURPROGRAM.patternfiles = calloc(CURPROGRAM.patternfile_size, sizeof(char *));
CURPROGRAM.reactions = 0;
//CURPROGRAM.logmask = ~0;
SETLOG(*conf, CURPROGRAM);
}
void conf_new_patternfile(struct config *conf) {
CURPROGRAM.npatternfiles++;
if (CURPROGRAM.npatternfiles == CURPROGRAM.patternfile_size) {
CURPROGRAM.patternfile_size *= 2;
CURPROGRAM.patternfiles = realloc(CURPROGRAM.patternfiles,
CURPROGRAM.patternfile_size * sizeof(char *));
}
}
void conf_new_input(struct config *conf) {
/* Bump number of programs and grow our programs array if necessary */
CURPROGRAM.ninputs++;
if (CURPROGRAM.ninputs == CURPROGRAM.input_size) {
CURPROGRAM.input_size *= 2;
CURPROGRAM.inputs = realloc(CURPROGRAM.inputs,
CURPROGRAM.input_size * sizeof(grok_input_t));
}
/* initialize the new input */
memset(&CURINPUT, 0, sizeof(grok_input_t));
SETLOG(CURPROGRAM, CURINPUT);
}
void conf_new_input_process(struct config *conf, char *cmd) {
conf_new_input(conf);
CURINPUT.type = I_PROCESS;
CURINPUT.source.process.cmd = cmd;
}
void conf_new_input_file(struct config *conf, char *filename) {
conf_new_input(conf);
CURINPUT.type = I_FILE;
CURINPUT.source.file.filename = filename;
}
void conf_new_matchconf(struct config *conf) {
CURPROGRAM.nmatchconfigs++;
if (CURPROGRAM.nmatchconfigs == CURPROGRAM.matchconfig_size) {
CURPROGRAM.matchconfig_size *= 2;
CURPROGRAM.matchconfigs = realloc(CURPROGRAM.matchconfigs,
CURPROGRAM.matchconfig_size
* sizeof(grok_matchconf_t));
}
grok_matchconfig_init(&CURPROGRAM, &CURMATCH);
/* Set sane defaults. */
CURMATCH.reaction = "%{@LINE}";
CURMATCH.shell = "stdout";
}
void conf_new_match_pattern(struct config *conf, const char *pattern) {
int compile_ret;
grok_t *grok;
grok = malloc(sizeof(grok_t));
grok_init(grok);
int i = 0;
for (i = 0; i < CURPROGRAM.npatternfiles; i++) {
grok_patterns_import_from_file(grok, CURPROGRAM.patternfiles[i]);
}
SETLOG(CURPROGRAM, *grok);
compile_ret = grok_compile(grok, pattern);
if (compile_ret != GROK_OK) {
fprintf(stderr, "Failure compiling pattern '%s': %s\n",
pattern, grok->errstr);
exit(1);
}
tclistpush(CURMATCH.grok_list, grok, sizeof(grok_t));
}
void conf_match_set_debug(struct config *conf, int logmask) {
int i = 0;
int listsize = tclistnum(CURMATCH.grok_list);
int unused_len;
for (i = 0; i < listsize; i++) {
grok_t *grok;
grok = (grok_t *)tclistval(CURMATCH.grok_list, i, &unused_len);
grok->logmask = logmask;
tclistover(CURMATCH.grok_list, i, grok, sizeof(grok_t));
}
}
|
