parseHTTP listens on a channel of raw http/openhttp log records, formats them and sends them to be linked with conn/openconn records and written to the database
(cfg *config.Config, http <-chan zeektypes.HTTP, output chan database.Data, importTime time.Time, numHTTP *uint64, numConn *uint64)
| 68 | |
| 69 | // parseHTTP listens on a channel of raw http/openhttp log records, formats them and sends them to be linked with conn/openconn records and written to the database |
| 70 | func parseHTTP(cfg *config.Config, http <-chan zeektypes.HTTP, output chan database.Data, importTime time.Time, numHTTP *uint64, numConn *uint64) { |
| 71 | logger := zlog.GetLogger() |
| 72 | |
| 73 | // loop over raw http/openhttp channel |
| 74 | for h := range http { |
| 75 | |
| 76 | // parse raw record as an http/open http entry |
| 77 | entry, err := formatHTTPRecord(cfg, &h, importTime) |
| 78 | if err != nil { |
| 79 | logger.Debug().Err(err). |
| 80 | Str("log_path", h.LogPath). |
| 81 | Str("zeek_uid", h.UID). |
| 82 | Str("timestamp", (time.Unix(int64(h.TimeStamp), 0)).String()). |
| 83 | Str("src", h.Source). |
| 84 | Str("dst", h.Destination). |
| 85 | Str("fqdn", h.Host). |
| 86 | Str("uri", h.URI). |
| 87 | Send() |
| 88 | continue |
| 89 | } |
| 90 | |
| 91 | // entry was subject to filtering |
| 92 | if entry == nil { |
| 93 | continue |
| 94 | } |
| 95 | |
| 96 | if entry.Host == "" { |
| 97 | atomic.AddUint64(numConn, 1) |
| 98 | } else { |
| 99 | atomic.AddUint64(numHTTP, 1) |
| 100 | } |
| 101 | |
| 102 | output <- entry |
| 103 | } |
| 104 | |
| 105 | } |
| 106 | |
| 107 | // formatHTTPRecord takes a raw http record and formats it into the structure needed by the database |
| 108 | func formatHTTPRecord(cfg *config.Config, parseHTTP *zeektypes.HTTP, importTime time.Time) (*HTTPEntry, error) { |
no test coverage detected