public Object apply()

in metron-platform/metron-management/src/main/java/org/apache/metron/management/GrokFunctions.java [71:130]


    public Object apply(List<Object> args, Context context) throws ParseException {
      String grokExpression = (String) args.get(0);
      Object arg =  args.get(1);
      if(grokExpression == null || arg == null) {
        return null;
      }
      List<String> strs = null;
      if(arg instanceof List) {
        strs = (List<String>) arg;
      }
      else if(arg instanceof String) {
        strs = new ArrayList<>();
        strs.add((String)arg);
      }
      else {
        return null;
      }
      Grok grok = null;
      try {
        grok = getGrok(grokExpression);
      } catch (GrokException e) {
        LOG.error("unable to parse {}: {}", grokExpression, e.getMessage(), e);
        return null;
      }
      List<Map<String, Object>> outputMap = new ArrayList<>();
      Set<String> keys = new TreeSet<>();
      for(String str : strs) {
        Match m = grok.match(str);
        m.captures();
        Map<String, Object> ret = m.toMap();
        if (ret != null && ret.isEmpty()) {
          outputMap.add(new HashMap<>());
        } else {
          ret.remove("pattern");
          keys.addAll(ret.keySet());
          outputMap.add(ret);
        }
      }
      if(keys.isEmpty()){
        return "NO MATCH";
      }
      String[] headers = new String[keys.size()];
      String[][] data = new String[outputMap.size()][keys.size()];
      {
        int i = 0;
        for (String key : keys) {
          headers[i++] = key;
        }
      }
      int rowNum = 0;
      for(Map<String, Object> output : outputMap) {
        String[] row = new String[keys.size()];
        int colNum = 0;
        for(String key : keys) {
          row[colNum++] = "" + output.getOrDefault(key, "MISSING");
        }
        data[rowNum++] = row;
      }
      return FlipTable.of(headers, data);
    }