Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var ( ErrInvalidFilter = func(rule, group string, err error) error { return fmt.Errorf("invalid filter %q in %q group: \n%v", rule, group, err) } ErrInvalidPatternBinding = func(rule string) error { return fmt.Errorf("%q is the initial sequence rule and can't contain pattern bindings", rule) } )
View Source
var ( // ErrPsNil indicates the process state associated with the event is not initialized ErrPsNil = errors.New("process state is nil") )
Functions ¶
This section is empty.
Types ¶
type ActionContext ¶ added in v1.4.0
type ActionContext struct {
Kevt *kevent.Kevent
Kevts map[string]*kevent.Kevent
Filter *config.FilterConfig
Group config.FilterGroup
}
ActionContext is the convenient structure for grouping the event that resulted in matched filter along with filter group information.
type Filter ¶
type Filter interface {
// Compile compiles the filter by parsing the filtering expression.
Compile() error
// Run runs a filter on the inbound kernel event and decides whether the event
// should be dropped or propagated to the downstream channel.
Run(kevt *kevent.Kevent) bool
// RunPartials runs a filter with stateful event tracking. Partials store all
// intermediate events that are the result of previous filter matches.
RunPartials(kevt *kevent.Kevent, partials map[uint16][]*kevent.Kevent) (bool, uint16, *kevent.Kevent)
// BindingIndex returns the binding index to which the filter is bound
// or a zero value if there are no pattern bindings defined.
BindingIndex() (uint16, bool)
}
Filter is the main interface for the filter engine implementors.
type Rules ¶ added in v1.4.0
type Rules struct {
// contains filtered or unexported fields
}
Rules stores the compiled filter groups and for each incoming event, it applies the corresponding filtering policies to the event, dropping the event or passing it accordingly. If the filter rule has an action, the former is executed when the rule fires.
Source Files
Directories
Click to show internal directories.
Click to hide internal directories.