76 lines
2.1 KiB
Go
76 lines
2.1 KiB
Go
// Licensed to Elasticsearch B.V. under one or more contributor
|
|
// license agreements. See the NOTICE file distributed with
|
|
// this work for additional information regarding copyright
|
|
// ownership. Elasticsearch B.V. licenses this file to you under
|
|
// the Apache License, Version 2.0 (the "License"); you may
|
|
// not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package beat
|
|
|
|
import (
|
|
"errors"
|
|
"time"
|
|
|
|
"github.com/elastic/beats/libbeat/common"
|
|
)
|
|
|
|
// Event is the common event format shared by all beats.
|
|
// Every event must have a timestamp and provide encodable Fields in `Fields`.
|
|
// The `Meta`-fields can be used to pass additional meta-data to the outputs.
|
|
// Output can optionally publish a subset of Meta, or ignore Meta.
|
|
type Event struct {
|
|
Timestamp time.Time
|
|
Meta common.MapStr
|
|
Fields common.MapStr
|
|
Private interface{} // for beats private use
|
|
}
|
|
|
|
var (
|
|
errNoTimestamp = errors.New("value is no timestamp")
|
|
)
|
|
|
|
// SetID overwrites the "id" field in the events metadata.
|
|
// If Meta is nil, a new Meta dictionary is created.
|
|
func (e *Event) SetID(id string) {
|
|
if e.Meta == nil {
|
|
e.Meta = common.MapStr{}
|
|
}
|
|
e.Meta["id"] = id
|
|
}
|
|
|
|
func (e *Event) GetValue(key string) (interface{}, error) {
|
|
if key == "@timestamp" {
|
|
return e.Timestamp, nil
|
|
}
|
|
return e.Fields.GetValue(key)
|
|
}
|
|
|
|
func (e *Event) PutValue(key string, v interface{}) (interface{}, error) {
|
|
if key == "@timestamp" {
|
|
switch ts := v.(type) {
|
|
case time.Time:
|
|
e.Timestamp = ts
|
|
case common.Time:
|
|
e.Timestamp = time.Time(ts)
|
|
default:
|
|
return nil, errNoTimestamp
|
|
}
|
|
}
|
|
|
|
// TODO: add support to write into '@metadata'?
|
|
return e.Fields.Put(key, v)
|
|
}
|
|
|
|
func (e *Event) Delete(key string) error {
|
|
return e.Fields.Delete(key)
|
|
}
|