helpers

type Asset struct {
	Name            string   `yaml:"name"`
	Hostnames       []string `yaml:"hostnames"`
	IPs             []string `yaml:"ips"`
	Confidentiality int32    `yaml:"confidentiality"`
	Availability    int32    `yaml:"availability"`
	Integrity       int32    `yaml:"integrity"`
}

type Cast struct {
	DataTypes []string `yaml:"data_types"`
	To        string   `yaml:"to"`
	Fields    []string `yaml:"fields"`
}

type Config struct {
	Grok          []Grok                            `yaml:"grok,omitempty"`
	Trim          []Trim                            `yaml:"trim,omitempty"`
	Rename        []Rename                          `yaml:"rename,omitempty"`
	Cast          []Cast                            `yaml:"cast,omitempty"`
	Reformat      []Reformat                        `yaml:"reformat,omitempty"`
	Delete        []Delete                          `yaml:"delete,omitempty"`
	Tenants       []Tenant                          `yaml:"tenants,omitempty"`
	Patterns      map[string]string                 `yaml:"patterns,omitempty"`
	DisabledRules []int64                           `yaml:"disabled_rules,omitempty"`
	Plugins       map[string]map[string]interface{} `yaml:"plugins,omitempty"`
	Env           Env                               `yaml:"-"`
}

type Delete struct {
	DataTypes []string `yaml:"data_types"`
	Fields    []string `yaml:"fields"`
}

type Env struct {
	NodeName   string
	NodeGroups []string
	Workdir    string
	LogLevel   int
}

type Grok struct {
	DataTypes []string  `yaml:"data_types"`
	Patterns  []Pattern `yaml:"patterns"`
}

type Pattern struct {
	FieldName string `yaml:"field_name"`
	Pattern   string `yaml:"pattern"`
}

type Reformat struct {
	DataTypes []string `yaml:"data_types"`
	Fields    []string `yaml:"fields"`
	Function  string   `yaml:"function"`
	From      string   `yaml:"from"`
	To        string   `yaml:"to"`
}

type Rename struct {
	DataTypes []string `yaml:"data_types"`
	To        string   `yaml:"to"`
	From      []string `yaml:"from"`
}

type Tenant struct {
	Name          string  `yaml:"name"`
	Id            string  `yaml:"id"`
	Assets        []Asset `yaml:"assets"`
	DisabledRules []int64 `yaml:"disabled_rules"`
}

type Trim struct {
	DataTypes []string `yaml:"data_types"`
	Function  string   `yaml:"function"`
	Substring string   `yaml:"substring"`
	Fields    []string `yaml:"fields"`
}