Method Compile

pkg/rules/engine.go:161–210

Compile loads macros/rules and builds an indexable filter set. For every rule in the ruleset the condition is compiled and converted into a filter. The filter is indexed by either the event name or event category.

()

// converted into a filter. The filter is indexed by either the
// event name or event category.
func (e *Engine) Compile() (*config.RulesCompileResult, error) {
	filters, rs, err := e.compiler.compile()
	if err != nil {
		return nil, err
	}

	for c, f := range filters {
		var ss *sequenceState
		if f.IsSequence() {
			ss = newSequenceState(f, c, e.psnap)
		}
		fltr := newCompiledFilter(f, c, ss)
		if ss != nil {
			// store the sequences in engine
			// for more convenient tracking
			e.sequences = append(e.sequences, ss)
		}

		if !fltr.isScoped() {
			log.Warnf("%q rule doesn't have "+
				"event type or event category condition! "+
				"This rule is being discarded by "+
				"the engine. Please consider narrowing the "+
				"scope of the rule by including the `evt.name` "+
				"or `evt.category` condition",
				c.Name)
			continue
		}

		// traverse all event name or category fields and determine
		// the event type from the filter field name expression.
		// We end up with a map of rules indexed by event type
		// or event category
		for name, values := range f.GetStringFields() {
			for _, v := range values {
				switch name {
				case fields.EvtName:
					for _, typ := range event.NameToTypes(v) {
						e.filters.types[typ] = append(e.filters.types[typ], fltr)
					}
				case fields.EvtCategory:
					category := event.Category(v)
					e.filters.categories[category.Index()] = append(e.filters.categories[category.Index()], fltr)
				}
			}
		}
	}

	return rs, nil
}

func (e *Engine) RegisterMatchFunc(fn RuleMatchFunc) {
	e.matchFunc = fn