class Fluent::Plugin::NaisKubeApiserverFilter

Public Instance Methods

filter(tag, time, record) click to toggle source
# File lib/fluent/plugin/filter_nais_kubeapiserver.rb, line 10
def filter(tag, time, record)
  if record.has_key?('auditID')
    record['x_level'] = record.delete('level')
    record['level'] = 'Audit'
    if record.has_key?('user')
      if record['user'].has_key?('username')
        if m = record['user']['username'].match(/^https:\/\/sts\.windows\.net.*\#(.+)/)
          record['x_username'] = record['user']['username']
          record['user'] = m[1]
        else
          record['user'] = record['user']['username']
        end
      end
    end
    record['method'] = record.delete('verb') if record.has_key?('verb')
    record['uri'] = record.delete('requestURI') if record.has_key?('requestURI')
    record.merge!(::Nais::Log::Parser.parse_uri(record['uri']))
    if record.has_key?('sourceIPs')
      ips = record['sourceIPs'].is_a?(Array) ? record['sourceIPs'] : [ record['sourceIPs'] ]
      ok = true
      ips.each{|ip|
        ok = (ip.is_a?(String) && ip =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/ ? true : false)
        break unless ok
      }
      record['remote_ip'] = record.delete('sourceIPs') if ok
    end
    record['@timestamp'] = record.delete('stageTimestamp') if record.has_key?('stageTimestamp')
    record.delete('apiVersion')
    record['message'] = record['method'] + ' ' + record['uri'] unless record.has_key?('message')
  end
  record
end