in dev/import-beats/kibana.go [453:521]
func stripReferencesToEventModuleInFilter(object mapStr, filterKey, moduleName string) (mapStr, error) {
filterValue, err := object.getValue(filterKey)
if err != nil && err != errKeyNotFound {
return nil, fmt.Errorf("retrieving key '%s' failed: %v", filterKey, err)
} else if err == errKeyNotFound {
return object, nil // nothing to adjust
}
filters, ok := filterValue.([]interface{})
if !ok {
return object, nil // not an array, ignoring
}
if len(filters) == 0 {
return object, nil // empty array, ignoring
}
var updatedFilters []mapStr
for _, fi := range filters {
filterObject, err := toMapStr(fi)
if err != nil {
return nil, errors.Wrapf(err, "converting to mapstr failed")
}
metaKeyObject, err := filterObject.getValue("meta.key")
if err != nil {
return nil, errors.Wrapf(err, "retrieving meta.key failed")
}
metaKey, ok := metaKeyObject.(string)
if ok && metaKey == "event.module" {
_, err = filterObject.put("meta.key", "query")
if err != nil {
return nil, errors.Wrapf(err, "setting meta.key failed")
}
_, err = filterObject.put("meta.type", "custom")
if err != nil {
return nil, errors.Wrapf(err, "setting meta.type failed")
}
_, err = filterObject.put("meta.value", fmt.Sprintf("{\"prefix\":{\"data_stream.dataset\":\"%s.\"}}", moduleName))
if err != nil {
return nil, errors.Wrapf(err, "setting meta.value failed")
}
err = filterObject.delete("meta.params")
if err != nil {
return nil, errors.Wrapf(err, "removing meta.params failed")
}
q := map[string]interface{}{
"prefix": map[string]interface{}{
"data_stream.dataset": moduleName + ".",
},
}
_, err = filterObject.put("query", q)
if err != nil {
return nil, errors.Wrapf(err, "setting query failed")
}
}
updatedFilters = append(updatedFilters, filterObject)
}
_, err = object.put(filterKey, updatedFilters)
if err != nil {
return nil, errors.Wrapf(err, "replacing filters failed (moduleName: %s)", moduleName)
}
return object, nil
}