collectors

type Collector interface {
	// Collect searches for logs matching the configured query and indicators,
	// and writes them to the output file. This is called once at the end of
	// scenario execution (when expectations pass or timeout is reached).
	// It returns the number of documents collected and any error that occurred.
	Collect(ctx context.Context, indicators map[string]string) (int, error)

	// String returns the textual, user-friendly representation of the collector
	String() string

	// GetOutputPath returns the path where the collected logs are stored
	GetOutputPath() string
}

type ElasticCollector struct {
	Config         *ElasticCollectorConfig
	ScenarioConfig *ElasticCollectorScenarioConfig
	Scenario       string
	// contains filtered or unexported fields
}

type ElasticCollectorConfig struct {
	ElasticsearchURL string `json:"elasticsearchUrl" yaml:"elasticsearchUrl"`
	CloudID          string `json:"cloudId" yaml:"cloudId"` // alternative to ElasticsearchURL
	APIKey           string `json:"apiKey" yaml:"apiKey"`
	OutputDir        string `json:"outputDir" yaml:"outputDir"` // default: "logs"
	// UserAgentField is the field used to search for user-agent containing detonation UUID
	UserAgentField string `json:"userAgentField" yaml:"userAgentField"`
}

type ElasticCollectorScenarioConfig struct {
	Index string `json:"index" yaml:"index"`
	// AdditionalFields values can be templates like "{{ indicators.terraformOutput.key }}"
	AdditionalFields map[string]string `json:"additionalFields,omitempty" yaml:"additionalFields,omitempty"`
}

type ElasticSearchHit struct {
	ID     string                 `json:"_id"`
	Index  string                 `json:"_index"`
	Source map[string]interface{} `json:"_source"`
}

type ElasticSearchResponse struct {
	Took int `json:"took"`
	Hits struct {
		Total struct {
			Value int `json:"value"`
		} `json:"total"`
		Hits []ElasticSearchHit `json:"hits"`
	} `json:"hits"`
}