darktemplar/auditd-plugin-clickhouse
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Revert "Process nested structures as arrays"

Browse Source 
This reverts commit 0f41d6a19c18a2ead8b709fab515cdb9770422ae.
This commit is contained in:
Aleksei Nikiforov 2019-12-17 14:39:06 +03:00
parent 0e852e9ad3
commit a0ea1c1f26
1 changed files with 26 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
auditd-record.cpp
View File

@ -273,8 +273,8 @@ void IntegerRecordField::addOrUpdateValue(auparse_state_t *record)
std::vector<AbstractRecordField::Column> IntegerRecordField::generateColumnsAndNames() const std::vector<AbstractRecordField::Column> IntegerRecordField::generateColumnsAndNames() const
{ {
return std::vector<AbstractRecordField::Column> { return std::vector<AbstractRecordField::Column> {
Column { m_name + ".IntValue", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnInt64>(), std::make_shared<clickhouse::ColumnUInt8>())) }, Column { m_name + ".IntValue", std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnInt64>(), std::make_shared<clickhouse::ColumnUInt8>()) },
Column { m_name + ".InterpretedValue", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnString>(), std::make_shared<clickhouse::ColumnUInt8>())) } Column { m_name + ".InterpretedValue", std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnString>(), std::make_shared<clickhouse::ColumnUInt8>()) }
}; };
} }
@ -285,43 +285,39 @@ void IntegerRecordField::addToColumn(const std::vector<Column> &columns) const
throw std::runtime_error("IntegerRecordField::addToColumn: invalid columns argument"); throw std::runtime_error("IntegerRecordField::addToColumn: invalid columns argument");
} }
auto array1 = columns[0].value->As<clickhouse::ColumnArray>(); auto nullable = columns[0].value->As<clickhouse::ColumnNullable>();
auto array2 = columns[1].value->As<clickhouse::ColumnArray>(); if (!nullable)
if ((!array1) || (!array2))
{ {
throw std::runtime_error("Invalid column type: not ColumnArray"); throw std::runtime_error("Invalid column type: not ColumnNullable");
} }
auto data_int_column = std::make_shared<clickhouse::ColumnInt64>(); auto nested = nullable->Nested();
auto null_int_column = std::make_shared<clickhouse::ColumnUInt8>(); if ((!nested) || (nested->Type()->GetCode() != clickhouse::Type::Int64))
{
throw std::runtime_error("Invalid nested column type: not Int64");
}
auto data_column = std::make_shared<clickhouse::ColumnInt64>();
auto null_column = std::make_shared<clickhouse::ColumnUInt8>();
if (m_int_value) if (m_int_value)
{ {
data_int_column->Append(*m_int_value); data_column->Append(*m_int_value);
null_int_column->Append(0); null_column->Append(0);
} }
else else
{ {
data_int_column->Append(0); data_column->Append(0);
null_int_column->Append(1); null_column->Append(1);
} }
auto data_str_column = std::make_shared<clickhouse::ColumnString>(); std::vector<Column> string_columns;
auto null_str_column = std::make_shared<clickhouse::ColumnUInt8>(); string_columns.push_back(columns[1]);
if (m_value) columns[0].value->Append(std::make_shared<clickhouse::ColumnNullable>(data_column, null_column));
{
data_str_column->Append(*m_value);
null_str_column->Append(0);
}
else
{
data_str_column->Append(std::string());
null_str_column->Append(1);
}
array1->AppendAsColumn(std::make_shared<clickhouse::ColumnNullable>(data_int_column, null_int_column)); // now also add string value
array2->AppendAsColumn(std::make_shared<clickhouse::ColumnNullable>(data_str_column, null_str_column)); InterpretedStringRecordField::addToColumn(string_columns);
} }
AbstractRecordField::Type IntegerRecordField::getType() const AbstractRecordField::Type IntegerRecordField::getType() const
@ -348,8 +344,8 @@ void InterpretedStringArrayRecordField::addOrUpdateValue(auparse_state_t *record
std::vector<AbstractRecordField::Column> InterpretedStringArrayRecordField::generateColumnsAndNames() const std::vector<AbstractRecordField::Column> InterpretedStringArrayRecordField::generateColumnsAndNames() const
{ {
return std::vector<AbstractRecordField::Column> { return std::vector<AbstractRecordField::Column> {
Column { m_name + ".Name", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>())) }, Column { m_name + ".Name", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>()) },
Column { m_name + ".Value", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>())) } Column { m_name + ".Value", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>()) }
}; };
} }
@ -384,14 +380,8 @@ void InterpretedStringArrayRecordField::addToColumn(const std::vector<Column> &c
value_column->Append(*iter); value_column->Append(*iter);
} }
auto array_internal_names = std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>()); array_names->AppendAsColumn(name_column);
auto array_internal_values = std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>()); array_values->AppendAsColumn(value_column);
array_internal_names->AppendAsColumn(name_column);
array_internal_values->AppendAsColumn(value_column);
array_names->AppendAsColumn(array_internal_names);
array_values->AppendAsColumn(array_internal_values);
} }
InterpretedStringArrayRecordField::InterpretedStringArrayRecordField(const std::string &name) InterpretedStringArrayRecordField::InterpretedStringArrayRecordField(const std::string &name)