in metron-platform/metron-management/src/main/java/org/apache/metron/management/GrokFunctions.java [71:130]
public Object apply(List<Object> args, Context context) throws ParseException {
String grokExpression = (String) args.get(0);
Object arg = args.get(1);
if(grokExpression == null || arg == null) {
return null;
}
List<String> strs = null;
if(arg instanceof List) {
strs = (List<String>) arg;
}
else if(arg instanceof String) {
strs = new ArrayList<>();
strs.add((String)arg);
}
else {
return null;
}
Grok grok = null;
try {
grok = getGrok(grokExpression);
} catch (GrokException e) {
LOG.error("unable to parse {}: {}", grokExpression, e.getMessage(), e);
return null;
}
List<Map<String, Object>> outputMap = new ArrayList<>();
Set<String> keys = new TreeSet<>();
for(String str : strs) {
Match m = grok.match(str);
m.captures();
Map<String, Object> ret = m.toMap();
if (ret != null && ret.isEmpty()) {
outputMap.add(new HashMap<>());
} else {
ret.remove("pattern");
keys.addAll(ret.keySet());
outputMap.add(ret);
}
}
if(keys.isEmpty()){
return "NO MATCH";
}
String[] headers = new String[keys.size()];
String[][] data = new String[outputMap.size()][keys.size()];
{
int i = 0;
for (String key : keys) {
headers[i++] = key;
}
}
int rowNum = 0;
for(Map<String, Object> output : outputMap) {
String[] row = new String[keys.size()];
int colNum = 0;
for(String key : keys) {
row[colNum++] = "" + output.getOrDefault(key, "MISSING");
}
data[rowNum++] = row;
}
return FlipTable.of(headers, data);
}