org.graylog2.inputs.converters.TokenizerConverter Maven / Gradle / Ivy

Show more of this group Show more artifacts with this name
Show all versions of graylog2-server Show documentation
Graylog
There is a newer version: 6.0.6
/**
 * This file is part of Graylog.
 *
 * Graylog is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * Graylog is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Graylog.  If not, see .
 */
package org.graylog2.inputs.converters;

import com.google.common.base.CharMatcher;
import com.google.common.collect.Maps;
import org.graylog2.plugin.inputs.Converter;

import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
 * @author Lennart Koopmann 
 */
public class TokenizerConverter extends Converter {

    private static final Pattern p = Pattern.compile("[a-zA-Z0-9_-]*");
    private static final Pattern kvPattern = Pattern.compile("\\s?=\\s?");
    private static final Pattern spacePattern = Pattern.compile(" ");
    private static final Pattern quotedValuePattern = Pattern.compile("([a-zA-Z0-9_-]+=\"[^\"]+\")");
    private static final CharMatcher QUOTE_MATCHER = CharMatcher.is('"').precomputed();
    private static final CharMatcher EQUAL_SIGN_MATCHER = CharMatcher.is('=').precomputed();

    public TokenizerConverter(Map config) {
        super(Type.TOKENIZER, config);
    }

    @Override
    public Object convert(String value) {
        if (value == null || value.isEmpty()) {
            return value;
        }

        Map fields = Maps.newHashMap();

        if (value.contains("=")) {
            final String nmsg = kvPattern.matcher(value).replaceAll("=");
            if (nmsg.contains("=\"")) {
                Matcher m = quotedValuePattern.matcher(nmsg);
                while (m.find()) {
                    String[] kv = m.group(1).split("=");
                    if (kv.length == 2 && p.matcher(kv[0]).matches()) {
                        fields.put(kv[0].trim(), QUOTE_MATCHER.removeFrom(kv[1]).trim());
                    }
                }
            } else {
                final String[] parts = spacePattern.split(nmsg);
                if (parts != null) {
                    for (String part : parts) {
                        if (part.contains("=") && EQUAL_SIGN_MATCHER.countIn(part) == 1) {
                            String[] kv = part.split("=");
                            if (kv.length == 2 && p.matcher(kv[0]).matches() && !fields.containsKey(kv[0])) {
                                fields.put(kv[0].trim(), kv[1].trim());
                            }
                        }
                    }
                }
            }
        }

        return fields;
    }

    @Override
    public boolean buildsMultipleFields() {
        return true;
    }


}