func (l *AuditLog) findInFile(fn string, query url.Values) ([]EventFields, error) {
	log.Infof("auditLog.findInFile(%s, %v)", fn, query)
	retval := make([]EventFields, 0)

	eventFilter := query[EventType]
	doFilter := len(eventFilter) > 0

	// open the log file:
	lf, err := os.OpenFile(fn, os.O_RDONLY, 0)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	defer lf.Close()

	// for each line...
	scanner := bufio.NewScanner(lf)
	for lineNo := 0; scanner.Scan(); lineNo++ {
		accepted := false
		// optimization: to avoid parsing JSON unnecessarily, lets see if we
		// can filter out lines that don't even have the requested event type on the line
		for i := range eventFilter {
			if strings.Contains(scanner.Text(), eventFilter[i]) {
				accepted = true
				break
			}
		}
		if doFilter && !accepted {
			continue
		}
		// parse JSON on the line and compare event type field to what's
		// in the query:
		var ef EventFields
		if err = json.Unmarshal(scanner.Bytes(), &ef); err != nil {
			log.Warnf("invalid JSON in %s line %d", fn, lineNo)
		}
		for i := range eventFilter {
			if ef.GetString(EventType) == eventFilter[i] {
				accepted = true
				break
			}
		}
		if accepted || !doFilter {
			retval = append(retval, ef)
		}
	}
	return retval, nil
}
// findInFile scans a given log file and returns events that fit the criteria
// This simplistic implementation ONLY SEARCHES FOR EVENT TYPE(s)
//
// You can pass multiple types like "event=session.start&event=session.end"
findInFile scans a given log file and returns events that fit the criteria
This simplistic implementation ONLY SEARCHES FOR EVENT TYPE(s)

You can pass multiple types like "event=session.start&event=session.end"
// findInFile scans a given log file and returns events that fit the criteria // This simplistic implementation ONLY SEARCHES FOR EVENT TYPE ( s ) // // You can pass multiple types like " event = session . start&event = session . end "
func (l *AuditLog) findInFile(fn string, query url.Values) ([]EventFields, error) {
	log.Infof("auditLog.findInFile(%s, %v)", fn, query)
	retval := make([]EventFields, 0)
	eventFilter := query[EventType]
	doFilter := len(eventFilter) > 0
	lf, err := os.OpenFile(fn, os.O_RDONLY, 0)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	defer lf.Close()
	scanner := bufio.NewScanner(lf)
	for lineNo := 0; scanner.Scan(); lineNo++ {
		accepted := false
		for i := range eventFilter {
			if strings.Contains(scanner.Text(), eventFilter[i]) {
				accepted = true
				break
			}
		}
		if doFilter && !accepted {
			continue
		}
		var ef EventFields
		if err = json.Unmarshal(scanner.Bytes(), &ef); err != nil {
			log.Warnf("invalid JSON in %s line %d", fn, lineNo)
		}
		for i := range eventFilter {
			if ef.GetString(EventType) == eventFilter[i] {
				accepted = true
				break
			}
		}
		if accepted || !doFilter {
			retval = append(retval, ef)
		}
	}
	return retval, nil
}
func ( l * AuditLog ) findInFile ( fn string , query url . Values ) ( [ ] EventFields , error ) { log . Infof ( " " , fn , query ) retval := make ( [ ] EventFields , 0 ) eventFilter := query [ EventType ] doFilter := len ( eventFilter ) > 0 lf , err := os . OpenFile ( fn , os . O_RDONLY , 0 ) if err != nil { return nil , trace . Wrap ( err ) } defer lf . Close ( ) scanner := bufio . NewScanner ( lf ) for lineNo := 0 ; scanner . Scan ( ) ; lineNo ++ { accepted := false for i := range eventFilter { if strings . Contains ( scanner . Text ( ) , eventFilter [ i ] ) { accepted = true break } } if doFilter && ! accepted { continue } var ef EventFields if err = json . Unmarshal ( scanner . Bytes ( ) , & ef ) ; err != nil { log . Warnf ( " " , fn , lineNo ) } for i := range eventFilter { if ef . GetString ( EventType ) == eventFilter [ i ] { accepted = true break } } if accepted || ! doFilter { retval = append ( retval , ef ) } } return retval , nil }
findInFile scans a given log file and returns events that fit the criteria
This simplistic implementation ONLY SEARCHES FOR EVENT TYPE(s)
findInFile scans a given log file and returns events that fit the criteria This simplistic implementation ONLY SEARCHES FOR EVENT TYPE ( s )
// open the log file: // for each line... // optimization: to avoid parsing JSON unnecessarily, lets see if we // can filter out lines that don't even have the requested event type on the line // parse JSON on the line and compare event type field to what's // in the query: