in metron-platform/metron-enrichment/metron-enrichment-common/src/main/java/org/apache/metron/enrichment/stellar/AsnEnrichmentFunctions.java [52:96]
public Object apply(List<Object> args, Context context) throws ParseException {
if (!initialized) {
return null;
}
if (args.size() > 2) {
throw new IllegalArgumentException(
"ASN_GET received more arguments than expected: " + args.size());
}
if (args.size() == 1 && args.get(0) instanceof String) {
// If no fields are provided, return everything
String ip = (String) args.get(0);
if (ip == null || ip.trim().isEmpty()) {
LOG.debug("No IP provided, returning null");
return null;
}
Optional<Map<String, Object>> result = GeoLiteAsnDatabase.INSTANCE.get(ip);
return result.orElse(Collections.EMPTY_MAP);
} else if (args.size() == 2 && args.get(1) instanceof List) {
// If fields are provided, return just those fields.
String ip = (String) args.get(0);
@SuppressWarnings("unchecked")
List<String> fields = (List) args.get(1);
Optional<Map<String, Object>> result = GeoLiteAsnDatabase.INSTANCE.get(ip);
// If only one field is requested, just return it directly
if (fields.size() == 1 && result.isPresent()) {
if (!result.get().containsKey(fields.get(0))) {
return null;
}
return result.get().get(fields.get(0));
} else if (result.isPresent()) {
// If multiple fields are requested, return all of them
Map<String, Object> filteredInfo = new HashMap<>();
for (String field : fields) {
Map<String, Object> asnInfo = result.get();
filteredInfo.put(field, asnInfo.get(field));
}
return filteredInfo;
}
}
return null;
}