darktemplar/auditd-plugin-clickhouse
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Revert "Process nested structures as arrays"

Browse Source 
This reverts commit 0f41d6a19c18a2ead8b709fab515cdb9770422ae.
This commit is contained in:
Aleksei Nikiforov 2019-12-17 14:39:06 +03:00
parent 0e852e9ad3
commit a0ea1c1f26
1 changed files with 26 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
auditd-record.cpp
View File

@ -273,8 +273,8 @@ void IntegerRecordField::addOrUpdateValue(auparse_state_t *record)
std::vector<AbstractRecordField::Column> IntegerRecordField::generateColumnsAndNames() const
{
return std::vector<AbstractRecordField::Column> {
Column { m_name + ".IntValue", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnInt64>(), std::make_shared<clickhouse::ColumnUInt8>())) },
Column { m_name + ".InterpretedValue", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnString>(), std::make_shared<clickhouse::ColumnUInt8>())) }
Column { m_name + ".IntValue", std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnInt64>(), std::make_shared<clickhouse::ColumnUInt8>()) },
Column { m_name + ".InterpretedValue", std::make_shared<clickhouse::ColumnNullable>(std::make_shared<clickhouse::ColumnString>(), std::make_shared<clickhouse::ColumnUInt8>()) }
};
}
@ -285,43 +285,39 @@ void IntegerRecordField::addToColumn(const std::vector<Column> &columns) const
throw std::runtime_error("IntegerRecordField::addToColumn: invalid columns argument");
}
auto array1 = columns[0].value->As<clickhouse::ColumnArray>();
auto array2 = columns[1].value->As<clickhouse::ColumnArray>();
if ((!array1) || (!array2))
auto nullable = columns[0].value->As<clickhouse::ColumnNullable>();
if (!nullable)
{
throw std::runtime_error("Invalid column type: not ColumnArray");
throw std::runtime_error("Invalid column type: not ColumnNullable");
}
auto data_int_column = std::make_shared<clickhouse::ColumnInt64>();
auto null_int_column = std::make_shared<clickhouse::ColumnUInt8>();
auto nested = nullable->Nested();
if ((!nested) || (nested->Type()->GetCode() != clickhouse::Type::Int64))
{
throw std::runtime_error("Invalid nested column type: not Int64");
}
auto data_column = std::make_shared<clickhouse::ColumnInt64>();
auto null_column = std::make_shared<clickhouse::ColumnUInt8>();
if (m_int_value)
{
data_int_column->Append(*m_int_value);
null_int_column->Append(0);
data_column->Append(*m_int_value);
null_column->Append(0);
}
else
{
data_int_column->Append(0);
null_int_column->Append(1);
data_column->Append(0);
null_column->Append(1);
}
auto data_str_column = std::make_shared<clickhouse::ColumnString>();
auto null_str_column = std::make_shared<clickhouse::ColumnUInt8>();
std::vector<Column> string_columns;
string_columns.push_back(columns[1]);
if (m_value)
{
data_str_column->Append(*m_value);
null_str_column->Append(0);
}
else
{
data_str_column->Append(std::string());
null_str_column->Append(1);
}
columns[0].value->Append(std::make_shared<clickhouse::ColumnNullable>(data_column, null_column));
array1->AppendAsColumn(std::make_shared<clickhouse::ColumnNullable>(data_int_column, null_int_column));
array2->AppendAsColumn(std::make_shared<clickhouse::ColumnNullable>(data_str_column, null_str_column));
// now also add string value
InterpretedStringRecordField::addToColumn(string_columns);
}
AbstractRecordField::Type IntegerRecordField::getType() const
@ -348,8 +344,8 @@ void InterpretedStringArrayRecordField::addOrUpdateValue(auparse_state_t *record
std::vector<AbstractRecordField::Column> InterpretedStringArrayRecordField::generateColumnsAndNames() const
{
return std::vector<AbstractRecordField::Column> {
Column { m_name + ".Name", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>())) },
Column { m_name + ".Value", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>())) }
Column { m_name + ".Name", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>()) },
Column { m_name + ".Value", std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>()) }
};
}
@ -384,14 +380,8 @@ void InterpretedStringArrayRecordField::addToColumn(const std::vector<Column> &c
value_column->Append(*iter);
}
auto array_internal_names = std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>());
auto array_internal_values = std::make_shared<clickhouse::ColumnArray>(std::make_shared<clickhouse::ColumnString>());
array_internal_names->AppendAsColumn(name_column);
array_internal_values->AppendAsColumn(value_column);
array_names->AppendAsColumn(array_internal_names);
array_values->AppendAsColumn(array_internal_values);
array_names->AppendAsColumn(name_column);
array_values->AppendAsColumn(value_column);
}
InterpretedStringArrayRecordField::InterpretedStringArrayRecordField(const std::string &name)