public static IList <NameValuePair> ExtractIpAddresses(IList <NameValuePair> fromValuesOf) { var ipv4s = fromValuesOf.Where(p => IpAddressesExtractor.IsIpv4Address(p.Value)) .Select(p => new NameValuePair() { Name = "IPv4", Value = p.Value }).ToList(); var ipv6s = fromValuesOf.Where(p => IpAddressesExtractor.IsIpv6Address(p.Value)) .Select(p => new NameValuePair() { Name = "IPv6", Value = p.Value }).ToList(); var all = new List <NameValuePair>(ipv4s); all.AddRange(ipv6s); return(all); }
private void ExtractDataFromMessage(ParserContext ctx) { var entry = ctx.Entry; // For RFC-5424 and KeyValue payload types, everything is already structured and extracted // But we want to run IP values detector against all of them switch (entry.PayloadType) { case PayloadType.Rfc5424: var allParams = entry.StructuredData.SelectMany(e => e.Value).ToList(); var Ips = IpAddressesExtractor.ExtractIpAddresses(allParams); entry.ExtractedData.AddRange(Ips); return; case PayloadType.KeyValuePairs: var Ips2 = IpAddressesExtractor.ExtractIpAddresses(entry.ExtractedData); entry.ExtractedData.AddRange(Ips2); return; } // otherwise run extractors from plain message if (entry == null || string.IsNullOrWhiteSpace(entry.Message) || entry.Message.Length < 10) { return; } var allValues = entry.ExtractedData; foreach (var extr in _valueExtractors) { var values = extr.ExtractValues(ctx); if (values != null && values.Count > 0) { allValues.AddRange(values); } } }