fn cef_to_map(cef_str: &str, preserve_orig: bool) -> Result<HashMap<String, String>> {
    // get the initial parsed struct
    let parsed = parse_cef_line(cef_str)?;
    let mut map = parsed.cef_header;

    if let Some(ahost) = parsed.ahost {
        // agent host available
        map.insert("ahost".to_string(), ahost);
    }
    if let Some(at) = parsed.at {
        // agent received time available
        map.insert("at".to_string(), at);
    }
    if let Some(facility) = parsed.syslog_facility {
        // syslog facility available
        map.insert("syslog_facility".to_string(), facility);
    }
    if let Some(pri) = parsed.syslog_priority {
        // syslog priority available
        map.insert("syslog_priority".to_string(), pri);
    }
    if !parsed.cef_ext.is_empty() {
        // get the cef extension
        map.extend(parse_cef_ext(&parsed.cef_ext));
    }
    if preserve_orig {
        // Preserve the raw log cef str
        map.insert("rawEvent".to_string(), cef_str.trim().to_string());
    }

    Ok(map)
}
/// Convert the CEF String into HashMap
Convert the CEF String into HashMap
Convert the CEF String into HashMap
fn cef_to_map(cef_str: &str, preserve_orig: bool) -> Result<HashMap<String, String>> {
    // get the initial parsed struct
    let parsed = parse_cef_line(cef_str)?;
    let mut map = parsed.cef_header;
    if let Some(ahost) = parsed.ahost {
        // agent host available
        map.insert("ahost".to_string(), ahost);
    }
    if let Some(at) = parsed.at {
        // agent received time available
        map.insert("at".to_string(), at);
    }
    if let Some(facility) = parsed.syslog_facility {
        // syslog facility available
        map.insert("syslog_facility".to_string(), facility);
    }
    if let Some(pri) = parsed.syslog_priority {
        // syslog priority available
        map.insert("syslog_priority".to_string(), pri);
    }
    if !parsed.cef_ext.is_empty() {
        // get the cef extension
        map.extend(parse_cef_ext(&parsed.cef_ext));
    }
    if preserve_orig {
        // Preserve the raw log cef str
        map.insert("rawEvent".to_string(), cef_str.trim().to_string());
    }
    Ok(map)
}
fn cef_to_map ( cef_str : & str , preserve_orig : bool ) -> Result < HashMap < String , String > > { // get the initial parsed struct let parsed = parse_cef_line ( cef_str ) ? ; let mut map = parsed . cef_header ; if let Some ( ahost ) = parsed . ahost { // agent host available map . insert ( " " . to_string ( ) , ahost ) ; } if let Some ( at ) = parsed . at { // agent received time available map . insert ( " " . to_string ( ) , at ) ; } if let Some ( facility ) = parsed . syslog_facility { // syslog facility available map . insert ( " " . to_string ( ) , facility ) ; } if let Some ( pri ) = parsed . syslog_priority { // syslog priority available map . insert ( " " . to_string ( ) , pri ) ; } if ! parsed . cef_ext . is_empty ( ) { // get the cef extension map . extend ( parse_cef_ext ( & parsed . cef_ext ) ) ; } if preserve_orig { // Preserve the raw log cef str map . insert ( " " . to_string ( ) , cef_str . trim ( ) . to_string ( ) ) ; } Ok ( map ) }
Convert the CEF String into HashMap
Convert the CEF String into HashMap
cef_str
&str
preserve_orig
bool
cef_str
&str
preserve_orig
bool