45
|
1 |
from pvl.syslog.filter import SyslogFilter
|
|
2 |
|
|
3 |
import re
|
|
4 |
|
|
5 |
import logging; log = logging.getLogger('pvl.syslog.rule')
|
|
6 |
|
|
7 |
class SyslogRule (object) :
|
|
8 |
"""
|
|
9 |
A rule matches syslog lines, and formats them.
|
|
10 |
|
|
11 |
tag - apply given tag to matches
|
|
12 |
"""
|
|
13 |
|
|
14 |
def __init__ (self, tag, program=None, pattern=None, format=None, flags=0) :
|
|
15 |
pattern = re.compile(pattern, flags)
|
|
16 |
|
|
17 |
self.filter = SyslogFilter(prog=program)
|
|
18 |
|
|
19 |
self.tag = tag
|
|
20 |
self.format = format
|
|
21 |
self.pattern = pattern
|
|
22 |
|
|
23 |
def apply (self, item) :
|
|
24 |
"""
|
|
25 |
Apply rule against given item.
|
|
26 |
"""
|
|
27 |
|
|
28 |
# filter
|
|
29 |
match = self.filter.filter(item)
|
|
30 |
|
|
31 |
log.debug("filter: %s", match)
|
|
32 |
|
|
33 |
if not match :
|
|
34 |
# ignore
|
|
35 |
return None
|
|
36 |
|
|
37 |
if self.pattern :
|
|
38 |
match = self.pattern.match(item['msg'])
|
|
39 |
|
|
40 |
if not match :
|
|
41 |
# ignore
|
|
42 |
return None
|
|
43 |
|
|
44 |
# apply
|
|
45 |
item.update(match.groupdict())
|
|
46 |
|
|
47 |
if self.tag is False :
|
|
48 |
# drop
|
|
49 |
return False
|
|
50 |
|
|
51 |
if self.format :
|
|
52 |
# return
|
|
53 |
return self.tag, self.format.format(**item)
|
|
54 |
|