darktemplar/auditd-plugin-clickhouse
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Modify integer record field to also store interpreted string value

Browse Source
This commit is contained in:
Aleksei Nikiforov 2019-12-09 12:19:58 +03:00
parent cfd18dd0d9
commit 826ae34d18
2 changed files with 87 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

126
auditd-record.cpp
View File

@ -100,66 +100,19 @@ AbstractRecordField::AbstractRecordField(const std::string &name)
{
}
std::shared_ptr<AbstractRecordField> IntegerRecordField::createRecord(const std::string &name, auparse_state_t *record)
{
std::shared_ptr<AbstractRecordField> result;
result.reset(new IntegerRecordField(name, record));
return result;
}
IntegerRecordField::IntegerRecordField(const std::string &name, auparse_state_t *record)
: AbstractRecordField(name)
{
if (record)
{
m_value = auparse_get_field_int(record);
}
}
void IntegerRecordField::addToColumn(clickhouse::ColumnRef column) const
{
auto nullable = column->As<clickhouse::ColumnNullable>();
if (!nullable)
{
throw std::runtime_error("Invalid column type: not ColumnNullable");
}
auto nested = nullable->Nested();
if ((!nested) || (nested->Type()->GetCode() != clickhouse::Type::Int64))
{
throw std::runtime_error("Invalid nested column type: not Int64");
}
auto data_column = std::make_shared<clickhouse::ColumnInt64>();
auto null_column = std::make_shared<clickhouse::ColumnUInt8>();
if (m_value)
{
data_column->Append(*m_value);
null_column->Append(0);
}
else
{
data_column->Append(0);
null_column->Append(1);
}
column->Append(std::make_shared<clickhouse::ColumnNullable>(data_column, null_column));
}
AbstractRecordField::Type IntegerRecordField::getType() const
{
return AbstractRecordField::Type::Int;
}
CommonStringRecordField::CommonStringRecordField(const std::string &name)
: AbstractRecordField(name)
{
}
void CommonStringRecordField::addToColumn(clickhouse::ColumnRef column) const
void CommonStringRecordField::addToColumn(const std::vector<clickhouse::ColumnRef> &columns) const
{
auto nullable = column->As<clickhouse::ColumnNullable>();
if ((columns.size() != 1) || (!columns[0]))
{
throw std::runtime_error("CommonStringRecordField::addToColumn: invalid columns argument");
}
auto nullable = columns[0]->As<clickhouse::ColumnNullable>();
if (!nullable)
{
throw std::runtime_error("Invalid column type: not ColumnNullable");
@ -185,7 +138,7 @@ void CommonStringRecordField::addToColumn(clickhouse::ColumnRef column) const
null_column->Append(1);
}
column->Append(std::make_shared<clickhouse::ColumnNullable>(data_column, null_column));
columns[0]->Append(std::make_shared<clickhouse::ColumnNullable>(data_column, null_column));
}
std::shared_ptr<AbstractRecordField> StringRecordField::createRecord(const std::string &name, auparse_state_t *record)
@ -229,3 +182,66 @@ AbstractRecordField::Type InterpretedStringRecordField::getType() const
{
return AbstractRecordField::Type::InterpretedString;
}
std::shared_ptr<AbstractRecordField> IntegerRecordField::createRecord(const std::string &name, auparse_state_t *record)
{
std::shared_ptr<AbstractRecordField> result;
result.reset(new IntegerRecordField(name, record));
return result;
}
IntegerRecordField::IntegerRecordField(const std::string &name, auparse_state_t *record)
: InterpretedStringRecordField(name, record)
{
if (record)
{
m_int_value = auparse_get_field_int(record);
}
}
void IntegerRecordField::addToColumn(const std::vector<clickhouse::ColumnRef> &columns) const
{
if ((columns.size() != 2) || (!columns[0]) || (!columns[1]))
{
throw std::runtime_error("IntegerRecordField::addToColumn: invalid columns argument");
}
auto nullable = columns[0]->As<clickhouse::ColumnNullable>();
if (!nullable)
{
throw std::runtime_error("Invalid column type: not ColumnNullable");
}
auto nested = nullable->Nested();
if ((!nested) || (nested->Type()->GetCode() != clickhouse::Type::Int64))
{
throw std::runtime_error("Invalid nested column type: not Int64");
}
auto data_column = std::make_shared<clickhouse::ColumnInt64>();
auto null_column = std::make_shared<clickhouse::ColumnUInt8>();
if (m_int_value)
{
data_column->Append(*m_int_value);
null_column->Append(0);
}
else
{
data_column->Append(0);
null_column->Append(1);
}
std::vector<clickhouse::ColumnRef> string_columns;
string_columns.push_back(columns[1]);
columns[0]->Append(std::make_shared<clickhouse::ColumnNullable>(data_column, null_column));
// now also add string value
InterpretedStringRecordField::addToColumn(string_columns);
}
AbstractRecordField::Type IntegerRecordField::getType() const
{
return AbstractRecordField::Type::Int;
}

32
auditd-record.hpp
View File

@ -49,7 +49,7 @@ public:
virtual ~AbstractRecordField() = default;
virtual void addToColumn(clickhouse::ColumnRef column) const = 0;
virtual void addToColumn(const std::vector<clickhouse::ColumnRef> &columns) const = 0;
virtual Type getType() const = 0;
std::string getName() const { return m_name; }
@ -103,24 +103,10 @@ protected:
std::map<auparse_type_t, std::function<std::shared_ptr<AbstractRecordField>(const std::string &name, auparse_state_t *record)> > m_factoryMap;
};
class IntegerRecordField: public AbstractRecordField
{
public:
static std::shared_ptr<AbstractRecordField> createRecord(const std::string &name, auparse_state_t *record);
virtual void addToColumn(clickhouse::ColumnRef column) const override;
virtual Type getType() const override;
protected:
IntegerRecordField(const std::string &name, auparse_state_t *record);
boost::optional<int> m_value;
};
class CommonStringRecordField: public AbstractRecordField
{
public:
virtual void addToColumn(clickhouse::ColumnRef column) const override;
virtual void addToColumn(const std::vector<clickhouse::ColumnRef> &columns) const override;
protected:
explicit CommonStringRecordField(const std::string &name);
@ -150,4 +136,18 @@ protected:
InterpretedStringRecordField(const std::string &name, auparse_state_t *record);
};
class IntegerRecordField: public InterpretedStringRecordField
{
public:
static std::shared_ptr<AbstractRecordField> createRecord(const std::string &name, auparse_state_t *record);
virtual void addToColumn(const std::vector<clickhouse::ColumnRef> &columns) const override;
virtual Type getType() const override;
protected:
IntegerRecordField(const std::string &name, auparse_state_t *record);
boost::optional<int> m_int_value;
};
#endif /* AUDITD_PLUGIN_CLICKHOUSE_RECORD_HPP */