MCPcopy
hub / github.com/crowdsecurity/crowdsec / Apply

Method Apply

pkg/parser/runtime.go:118–211  ·  view source on GitHub ↗
(event *pipeline.Event, enrichFunctions EnricherCtx, logger *log.Entry, debug bool)

Source from the content-addressed store, hash-verified

116}
117
118func (rs *RuntimeStatic) Apply(event *pipeline.Event, enrichFunctions EnricherCtx, logger *log.Entry, debug bool) error {
119 // we have a few cases :
120 // (meta||key) + (static||reference||expr)
121 exprEnv := map[string]any{"evt": event}
122 value := ""
123
124 if rs.Config.Value != "" {
125 value = rs.Config.Value
126 } else if rs.RunTimeValue != nil {
127 output, err := exprhelpers.Run(rs.RunTimeValue, exprEnv, logger, debug)
128 if err != nil {
129 logger.Warningf("failed to run RunTimeValue : %v", err)
130 return nil
131 }
132
133 switch out := output.(type) {
134 case string:
135 value = out
136 case int:
137 value = strconv.Itoa(out)
138 case float64, float32:
139 value = fmt.Sprintf("%f", out)
140 case map[string]any:
141 logger.Warnf("Expression %q returned a map, please use ToJsonString() to convert it to string if you want to keep it as is, or refine your expression to extract a string", rs.Config.ExpValue)
142 case []any:
143 logger.Warnf("Expression %q returned an array, please use ToJsonString() to convert it to string if you want to keep it as is, or refine your expression to extract a string", rs.Config.ExpValue)
144 case nil:
145 logger.Debugf("Expression %q returned nil, skipping", rs.Config.ExpValue)
146 default:
147 logger.Errorf("unexpected return type for %q: %T", rs.Config.ExpValue, output)
148 return errors.New("unexpected return type for RunTimeValue")
149 }
150 }
151
152 if value == "" {
153 // allow ParseDate to have empty input
154 if rs.Config.Method != "ParseDate" {
155 logger.Debugf("Empty value for %s, skip.", rs.Config.targetExpr())
156 return nil
157 }
158 }
159
160 switch {
161 case rs.Config.Method != "":
162 processed := false
163 /*still way too hackish, but : inject all the results in enriched, and */
164 if enricherPlugin, ok := enrichFunctions.Registered[rs.Config.Method]; ok {
165 logger.Tracef("Found method '%s'", rs.Config.Method)
166
167 ret, err := enricherPlugin.EnrichFunc(value, event, logger.WithField("method", rs.Config.Method))
168 if err != nil {
169 logger.Errorf("method '%s' returned an error : %v", rs.Config.Method, err)
170 }
171
172 processed = true
173
174 logger.Debugf("+ Method %s('%s') returned %d entries to merge in .Enriched\n", rs.Config.Method, value, len(ret))
175 // Hackish check, but those methods do not return any data by design

Callers 2

ProcessStaticsMethod · 0.45
ProcessStaticsMethod · 0.45

Calls 4

RunFunction · 0.92
SetTargetByNameFunction · 0.85
targetExprMethod · 0.80
TracefMethod · 0.80

Tested by

no test coverage detected