From a0ea1c1f26857c1551e79352722ddade2c532815 Mon Sep 17 00:00:00 2001
From: Aleksei Nikiforov <darktemplar@altlinux.org>
Date: Tue, 17 Dec 2019 14:39:06 +0300
Subject: [PATCH] Revert "Process nested structures as arrays"

This reverts commit 0f41d6a19c18a2ead8b709fab515cdb9770422ae.
---
 auditd-record.cpp | 62 ++++++++++++++++++++---------------------------
 1 file changed, 26 insertions(+), 36 deletions(-)

diff --git a/auditd-record.cpp b/auditd-record.cpp
index 5d0bd8b..f965782 100644
--- a/auditd-record.cpp
+++ b/auditd-record.cpp
@@ -273,8 +273,8 @@ void IntegerRecordField::addOrUpdateValue(auparse_state_t *record)
 std::vector<AbstractRecordField::Column> IntegerRecordField::generateColumnsAndNames() const
 {
 	return std::vector<AbstractRecordField::Column> {
-		Column { m_name + ".IntValue", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnInt64>(), std::make_shared<clickhouse::ColumnUInt8>())) },
-		Column { m_name + ".InterpretedValue", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnString>(), std::make_shared<clickhouse::ColumnUInt8>())) }
+		Column { m_name + ".IntValue", std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnInt64>(), std::make_shared<clickhouse::ColumnUInt8>()) },
+		Column { m_name + ".InterpretedValue", std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnString>(), std::make_shared<clickhouse::ColumnUInt8>()) }
 	};
 }
 
@@ -285,43 +285,39 @@ void IntegerRecordField::addToColumn(const std::vector<Column> &columns) const
 		throw std::runtime_error("IntegerRecordField::addToColumn: invalid columns argument");
 	}
 
-	auto array1 = columns[0].value->As<clickhouse::ColumnArray>();
-	auto array2 = columns[1].value->As<clickhouse::ColumnArray>();
-	if ((!array1) || (!array2))
+	auto nullable = columns[0].value->As<clickhouse::ColumnNullable>();
+	if (!nullable)
 	{
-		throw std::runtime_error("Invalid column type: not ColumnArray");
+		throw std::runtime_error("Invalid column type: not ColumnNullable");
 	}
 
-	auto data_int_column = std::make_shared<clickhouse::ColumnInt64>();
-	auto null_int_column = std::make_shared<clickhouse::ColumnUInt8>();
+	auto nested = nullable->Nested();
+	if ((!nested) || (nested->Type()->GetCode() != clickhouse::Type::Int64))
+	{
+		throw std::runtime_error("Invalid nested column type: not Int64");
+	}
+	
+	auto data_column = std::make_shared<clickhouse::ColumnInt64>();
+	auto null_column = std::make_shared<clickhouse::ColumnUInt8>();
 
 	if (m_int_value)
 	{
-		data_int_column->Append(*m_int_value);
-		null_int_column->Append(0);
+		data_column->Append(*m_int_value);
+		null_column->Append(0);
 	}
 	else
 	{
-		data_int_column->Append(0);
-		null_int_column->Append(1);
+		data_column->Append(0);
+		null_column->Append(1);
 	}
 
-	auto data_str_column = std::make_shared<clickhouse::ColumnString>();
-	auto null_str_column = std::make_shared<clickhouse::ColumnUInt8>();
+	std::vector<Column> string_columns;
+	string_columns.push_back(columns[1]);
 
-	if (m_value)
-	{
-		data_str_column->Append(*m_value);
-		null_str_column->Append(0);
-	}
-	else
-	{
-		data_str_column->Append(std::string());
-		null_str_column->Append(1);
-	}
+	columns[0].value->Append(std::make_shared<clickhouse::ColumnNullable>(data_column, null_column));
 
-	array1->AppendAsColumn(std::make_shared<clickhouse::ColumnNullable>(data_int_column, null_int_column));
-	array2->AppendAsColumn(std::make_shared<clickhouse::ColumnNullable>(data_str_column, null_str_column));
+	// now also add string value
+	InterpretedStringRecordField::addToColumn(string_columns);
 }
 
 AbstractRecordField::Type IntegerRecordField::getType() const
@@ -348,8 +344,8 @@ void InterpretedStringArrayRecordField::addOrUpdateValue(auparse_state_t *record
 std::vector<AbstractRecordField::Column> InterpretedStringArrayRecordField::generateColumnsAndNames() const
 {
 	return std::vector<AbstractRecordField::Column> {
-		Column { m_name + ".Name", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>())) },
-		Column { m_name + ".Value", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>())) }
+		Column { m_name + ".Name", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>()) },
+		Column { m_name + ".Value", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>()) }
 	};
 }
 
@@ -384,14 +380,8 @@ void InterpretedStringArrayRecordField::addToColumn(const std::vector<Column> &c
 		value_column->Append(*iter);
 	}
 
-	auto array_internal_names  = std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>());
-	auto array_internal_values = std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>());
-
-	array_internal_names->AppendAsColumn(name_column);
-	array_internal_values->AppendAsColumn(value_column);
-
-	array_names->AppendAsColumn(array_internal_names);
-	array_values->AppendAsColumn(array_internal_values);
+	array_names->AppendAsColumn(name_column);
+	array_values->AppendAsColumn(value_column);
 }
 
 InterpretedStringArrayRecordField::InterpretedStringArrayRecordField(const std::string &name)