RegexDeserializer extends Deserializer { @Override public DeserializedEvent deserialize(String raw) { Matcher m = this.pattern.matcher(raw); if (!m.matches()) { throw new DeserializationException("raw event does not match string"); } int groups = m.groupCount(); JsonObject obj = new JsonObject(); for (int i = 0; i < groups && i < fields.size(); i++) { String str = m.group(i + 1); ReFieldConfig field = this.fields.get(i); switch (field.getType()) { case BOOLEAN: obj.addProperty(field.getName(), Boolean.parseBoolean(str)); break; case NUMBER: obj.addProperty(field.getName(), NumberUtils.createNumber(str)); break; case STRING: obj.addProperty(field.getName(), str); break; default: obj.addProperty(field.getName(), str); break; } } return new GenericJsonEvent(obj); } RegexDeserializer(final Pattern pattern, final List<ReFieldConfig> fields); @Override DeserializedEvent deserialize(String raw); @Override void init();  }
@Test public void testSingleMatch() throws FieldNotFoundException { List<ReFieldConfig> fields = new ArrayList<>(); fields.add(new ReFieldConfig("foo", ReFieldType.STRING)); Pattern p = Pattern.compile("(.*)"); RegexDeserializer deser = new RegexDeserializer(p, fields); DeserializedEvent event = deser.deserialize("test i am"); assertEquals("test i am", event.getField("foo")); }
@Test(expected = DeserializationException.class) public void testNoMatches() { List<ReFieldConfig> fields = new ArrayList<>(); fields.add(new ReFieldConfig("foo", ReFieldType.STRING)); Pattern p = Pattern.compile("(test i am)"); RegexDeserializer deser = new RegexDeserializer(p, fields); DeserializedEvent event = deser.deserialize("i am a test"); }
@Test public void testTestAlbLog() throws FieldNotFoundException { List<ReFieldConfig> fields = new ArrayList<>(); fields.add(new ReFieldConfig("type", ReFieldType.STRING)); fields.add(new ReFieldConfig("timestamp", ReFieldType.STRING)); fields.add(new ReFieldConfig("elb", ReFieldType.STRING)); fields.add(new ReFieldConfig("client_ip", ReFieldType.STRING)); fields.add(new ReFieldConfig("client_port", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("target_ip", ReFieldType.STRING)); fields.add(new ReFieldConfig("target_port", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("request_processing_time", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("target_processing_time", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("response_processing_time", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("elb_status_code", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("target_status_code", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("received_bytes", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("sent_bytes", ReFieldType.NUMBER)); fields.add(new ReFieldConfig("request_verb", ReFieldType.STRING)); fields.add(new ReFieldConfig("url", ReFieldType.STRING)); fields.add(new ReFieldConfig("protocol", ReFieldType.STRING)); fields.add(new ReFieldConfig("user_agent", ReFieldType.STRING)); fields.add(new ReFieldConfig("ssl_cipher", ReFieldType.STRING)); fields.add(new ReFieldConfig("ssl_protocol", ReFieldType.STRING)); fields.add(new ReFieldConfig("target_group_arn", ReFieldType.STRING)); fields.add(new ReFieldConfig("trace_id", ReFieldType.STRING)); Pattern p = Pattern.compile( "([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*):([0-9]*) ([^ ]*):([0-9]*) ([.0-9]*) ([.0-9]*) ([.0-9]*) (-|[0-9]*) (-|[0-9]*) ([-0-9]*) ([-0-9]*) \\\"([^ ]*) ([^ ]*) (- |[^ ]*)\\\" (\\\"[^\\\"]*\\\") ([A-Z0-9-]+) ([A-Za-z0-9.-]*) ([^ ]*) ([^ ]*)$", Pattern.DOTALL); RegexDeserializer deser = new RegexDeserializer(p, fields); DeserializedEvent event = deser.deserialize( "https 2017-06-15T04:55:00.142369Z app/foo/1234 127.12.12.12:1337 127.13.13.13:7331 1.001 2.002 3.003 201 200 687 461 \"GET https: assertEquals("https", event.getField("type")); assertEquals("2017-06-15T04:55:00.142369Z", event.getField("timestamp")); assertEquals("app/foo/1234", event.getField("elb")); assertEquals("127.12.12.12", event.getField("client_ip")); assertEquals(new JsonPrimitive(1337), event.getField("client_port")); assertEquals("127.13.13.13", event.getField("target_ip")); assertEquals(new JsonPrimitive(7331), event.getField("target_port")); assertEquals("1.001", event.getFieldAsString("request_processing_time")); assertEquals(new JsonPrimitive(new Double(2.002)), event.getField("target_processing_time")); assertEquals(new JsonPrimitive(new Double(3.003)), event.getField("response_processing_time")); assertEquals(new JsonPrimitive(201), event.getField("elb_status_code")); assertEquals(new JsonPrimitive(200), event.getField("target_status_code")); assertEquals(new JsonPrimitive(687), event.getField("received_bytes")); assertEquals(new JsonPrimitive(461), event.getField("sent_bytes")); assertEquals("GET", event.getField("request_verb")); assertEquals("https: assertEquals("HTTP/1.1", event.getField("protocol")); assertEquals("\"123-123-123-123-123\"", event.getField("user_agent")); assertEquals("ECDHE-RSA-AES128-GCM-SHA256", event.getField("ssl_cipher")); assertEquals("TLSv1.2", event.getField("ssl_protocol")); assertEquals("arn:aws:elasticloadbalancing:us-west-1:123:targetgroup/foo-bar-https/123", event.getField("target_group_arn")); assertEquals("\"Root=1-123-123\"", event.getField("trace_id")); }