public static IList <NameValuePair> ExtractIpAddresses(IList <NameValuePair> fromValuesOf)
{
var ipv4s = fromValuesOf.Where(p => IpAddressesExtractor.IsIpv4Address(p.Value))
.Select(p => new NameValuePair()
{
Name = "IPv4", Value = p.Value
}).ToList();
var ipv6s = fromValuesOf.Where(p => IpAddressesExtractor.IsIpv6Address(p.Value))
.Select(p => new NameValuePair()
{
Name = "IPv6", Value = p.Value
}).ToList();
var all = new List <NameValuePair>(ipv4s);
all.AddRange(ipv6s);
return(all);
}
private void ExtractDataFromMessage(ParserContext ctx)
{
var entry = ctx.Entry;
// For RFC-5424 and KeyValue payload types, everything is already structured and extracted
// But we want to run IP values detector against all of them
switch (entry.PayloadType)
{
case PayloadType.Rfc5424:
var allParams = entry.StructuredData.SelectMany(e => e.Value).ToList();
var Ips = IpAddressesExtractor.ExtractIpAddresses(allParams);
entry.ExtractedData.AddRange(Ips);
return;
case PayloadType.KeyValuePairs:
var Ips2 = IpAddressesExtractor.ExtractIpAddresses(entry.ExtractedData);
entry.ExtractedData.AddRange(Ips2);
return;
}
// otherwise run extractors from plain message
if (entry == null || string.IsNullOrWhiteSpace(entry.Message) || entry.Message.Length < 10)
{
return;
}
var allValues = entry.ExtractedData;
foreach (var extr in _valueExtractors)
{
var values = extr.ExtractValues(ctx);
if (values != null && values.Count > 0)
{
allValues.AddRange(values);
}
}
}
