// create mapping table for the fieldNames to capture
private GrokPattern resolveFieldNames(GrokPattern pattern)
{
//var nestLevel = 0;
//var inRangeDef = 0;
//var matched="";
//var matches=nestedFieldNamesRegex.Matches(pattern.Resolved);
//matched = matches[0].Value;
// switch (matched[0].ToString())
// {
// case "(": { if (inRangeDef>0) { ++nestLevel; pattern.Fields.Add(null); } break; }
// case "\\(": break; // can be ignored
// case "\\)": break; // can be ignored
// case ")": { if (inRangeDef>0) { --nestLevel; } break; }
// case "[": { ++inRangeDef; break; }
// case "\\[": break; // can be ignored
// case "\\]": break; // can be ignored
// case "]": { --inRangeDef; break; }
// case "(?:": // fallthrough // group not captured
// case "(?>": // fallthrough // atomic group
// case "(?!": // fallthrough // negative look-ahead
// case "(?<!": { if (inRangeDef>0) { ++nestLevel; } break; } // negative look-behind
// default: { ++nestLevel; pattern.Fields.Add(matched[2].ToString()); break; }
// }
return pattern;
}
// create mapping table for the fieldNames to capture
private GrokPattern resolveFieldNames(GrokPattern pattern)
{
//var nestLevel = 0;
//var inRangeDef = 0;
//var matched="";
//var matches=nestedFieldNamesRegex.Matches(pattern.Resolved);
//matched = matches[0].Value;
// switch (matched[0].ToString())
// {
// case "(": { if (inRangeDef>0) { ++nestLevel; pattern.Fields.Add(null); } break; }
// case "\\(": break; // can be ignored
// case "\\)": break; // can be ignored
// case ")": { if (inRangeDef>0) { --nestLevel; } break; }
// case "[": { ++inRangeDef; break; }
// case "\\[": break; // can be ignored
// case "\\]": break; // can be ignored
// case "]": { --inRangeDef; break; }
// case "(?:": // fallthrough // group not captured
// case "(?>": // fallthrough // atomic group
// case "(?!": // fallthrough // negative look-ahead
// case "(?<!": { if (inRangeDef>0) { ++nestLevel; } break; } // negative look-behind
// default: { ++nestLevel; pattern.Fields.Add(matched[2].ToString()); break; }
// }
return(pattern);
}
public static void Load(string filePath)
{
if (Patterns == null)
{
Patterns = new Hashtable();
}
var files = Directory.GetFiles(filePath);
foreach (var file in files)
{
var lines = File.ReadAllLines(file);
foreach (var item in lines)
{
if (!item.StartsWith("#") && !item.StartsWith(" ") && !string.IsNullOrEmpty(item))
{
var id = item.Split(' ')[0];
var express = item.Substring(item.IndexOf(' '));
var pattern = new GrokPattern()
{
Expression = express, Id = id
};
if (!Patterns.ContainsKey(pattern.Id))
{
Patterns.Add(pattern.Id, pattern);
}
}
}
}
}
// TODO: support automatic type conversion (e.g., "%{NUMBER:duration:float}"; see: https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)
private GrokPattern resolveSubPatterns(GrokPattern pattern)
{
var express = pattern.Expression;
var subPatterns = subPatternsRegex.Matches(pattern.Expression);
foreach (Match item in subPatterns)
{ // matched is: %{subPatternName} or %{subPatternName:fieldName}
var matched = item.Value;
var subPatternName = matched.Substring(2, matched.Length - 3);
var elements = subPatternName.Split(':');
subPatternName = elements[0];
var fieldName = "";
if (elements.Length > 1)
{
fieldName = elements[1];
}
if (!Patterns.ContainsKey(subPatternName))
{
throw new Exception("不存在模式");
}
var subPattern = (GrokPattern)Patterns[subPatternName];
if (string.IsNullOrEmpty(subPattern.Resolved))
{
ResolvePattern(subPattern);
}
if (!string.IsNullOrEmpty(fieldName))
{
express = express.Replace(matched, "(?<" + fieldName + ">" + subPattern.Resolved + ")");
}
else
{
express = express.Replace(matched, subPattern.Resolved);
}
}
pattern.Resolved = express;
return(pattern);
}
public GrokPattern createPattern(string expression, string id = "")
{
var pid = id;
if (string.IsNullOrEmpty(pid))
{
pid = "pattern-" + Patterns.Count;
}
if (Patterns.Contains(pid))
{
throw new Exception("已存在的模式id");
}
else
{
GrokPattern pattern = new GrokPattern()
{
Id = pid, Expression = expression
};
return(ResolvePattern(pattern));
}
}
// TODO: support automatic type conversion (e.g., "%{NUMBER:duration:float}"; see: https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)
private GrokPattern resolveSubPatterns(GrokPattern pattern)
{
var express = pattern.Expression;
var subPatterns= subPatternsRegex.Matches(pattern.Expression);
foreach (Match item in subPatterns)
{ // matched is: %{subPatternName} or %{subPatternName:fieldName}
var matched = item.Value;
var subPatternName = matched.Substring(2, matched.Length - 3);
var elements = subPatternName.Split(':');
subPatternName = elements[0];
var fieldName = "";
if (elements.Length>1)
{
fieldName = elements[1];
}
if (!Patterns.ContainsKey(subPatternName))
{
throw new Exception("不存在模式");
}
var subPattern =(GrokPattern) Patterns[subPatternName];
if (string.IsNullOrEmpty(subPattern.Resolved))
{
ResolvePattern(subPattern);
}
if (!string.IsNullOrEmpty(fieldName))
{
express = express.Replace(matched, "(?<" + fieldName + ">" + subPattern.Resolved + ")");
}
else {
express = express.Replace(matched, subPattern.Resolved);
}
}
pattern.Resolved = express;
return pattern;
}
public GrokPattern ResolvePattern(GrokPattern pattern)
{
pattern = resolveSubPatterns(pattern);
pattern = resolveFieldNames(pattern);
return pattern;
}
public static void Load (string filePath)
{
if (Patterns == null)
{
Patterns = new Hashtable();
}
var files= Directory.GetFiles(filePath);
foreach (var file in files)
{
var lines = File.ReadAllLines(file);
foreach (var item in lines)
{
if (!item.StartsWith("#")&&!item.StartsWith(" ")&&!string.IsNullOrEmpty(item))
{
var id = item.Split(' ')[0];
var express = item.Substring(item.IndexOf(' '));
var pattern = new GrokPattern() { Expression = express, Id = id };
if (!Patterns.ContainsKey(pattern.Id))
{
Patterns.Add(pattern.Id, pattern);
}
}
}
}
}
public GrokPattern createPattern(string expression,string id="")
{
var pid = id;
if (string.IsNullOrEmpty(pid))
{
pid = "pattern-" + Patterns.Count;
}
if (Patterns.Contains(pid))
{
throw new Exception("已存在的模式id");
}
else
{
GrokPattern pattern = new GrokPattern() { Id = pid, Expression = expression };
return ResolvePattern(pattern);
}
}
public GrokPattern ResolvePattern(GrokPattern pattern)
{
pattern = resolveSubPatterns(pattern);
pattern = resolveFieldNames(pattern);
return(pattern);
}