func stripReferencesToEventModuleInFilter()

in dev/import-beats/kibana.go [453:521]


func stripReferencesToEventModuleInFilter(object mapStr, filterKey, moduleName string) (mapStr, error) {
	filterValue, err := object.getValue(filterKey)
	if err != nil && err != errKeyNotFound {
		return nil, fmt.Errorf("retrieving key '%s' failed: %v", filterKey, err)
	} else if err == errKeyNotFound {
		return object, nil // nothing to adjust
	}

	filters, ok := filterValue.([]interface{})
	if !ok {
		return object, nil // not an array, ignoring
	}
	if len(filters) == 0 {
		return object, nil // empty array, ignoring
	}

	var updatedFilters []mapStr
	for _, fi := range filters {
		filterObject, err := toMapStr(fi)
		if err != nil {
			return nil, errors.Wrapf(err, "converting to mapstr failed")
		}

		metaKeyObject, err := filterObject.getValue("meta.key")
		if err != nil {
			return nil, errors.Wrapf(err, "retrieving meta.key failed")
		}

		metaKey, ok := metaKeyObject.(string)
		if ok && metaKey == "event.module" {
			_, err = filterObject.put("meta.key", "query")
			if err != nil {
				return nil, errors.Wrapf(err, "setting meta.key failed")
			}

			_, err = filterObject.put("meta.type", "custom")
			if err != nil {
				return nil, errors.Wrapf(err, "setting meta.type failed")
			}

			_, err = filterObject.put("meta.value", fmt.Sprintf("{\"prefix\":{\"data_stream.dataset\":\"%s.\"}}", moduleName))
			if err != nil {
				return nil, errors.Wrapf(err, "setting meta.value failed")
			}

			err = filterObject.delete("meta.params")
			if err != nil {
				return nil, errors.Wrapf(err, "removing meta.params failed")
			}

			q := map[string]interface{}{
				"prefix": map[string]interface{}{
					"data_stream.dataset": moduleName + ".",
				},
			}
			_, err = filterObject.put("query", q)
			if err != nil {
				return nil, errors.Wrapf(err, "setting query failed")
			}
		}
		updatedFilters = append(updatedFilters, filterObject)
	}

	_, err = object.put(filterKey, updatedFilters)
	if err != nil {
		return nil, errors.Wrapf(err, "replacing filters failed (moduleName: %s)", moduleName)
	}
	return object, nil
}