in aucoalesce/normalize.go [191:224]
func LoadNormalizationConfig(b []byte) (syscalls map[string]*Normalization, recordTypes map[string][]*Normalization, err error) {
c := &NormalizationConfig{}
dec := yaml.NewDecoder(bytes.NewReader(b))
dec.KnownFields(true)
if err := dec.Decode(c); err != nil {
return nil, nil, err
}
syscalls = map[string]*Normalization{}
recordTypes = map[string][]*Normalization{}
for i := range c.Normalizations {
norm := c.Normalizations[i]
for _, syscall := range norm.Syscalls.Values {
if _, found := syscalls[syscall]; found {
return nil, nil, fmt.Errorf("duplication mappings for syscall %v", syscall)
}
syscalls[syscall] = &norm
}
for _, recordType := range norm.RecordTypes.Values {
norms, found := recordTypes[recordType]
if found {
for _, n := range norms {
if len(n.HasFields.Values) == 0 {
return nil, nil, fmt.Errorf("duplication mappings for record_type %v without has_fields qualifier", recordType)
}
}
}
recordTypes[recordType] = append(norms, &norm)
}
}
return syscalls, recordTypes, nil
}