class Unified2::Extra
Constants
- EXTRA_TYPES
Type 1: True-Client-IP/XFF IPv4 address Type 2: True-Client-IP/XFF IPv6 address Type 3: ??? Type 4: HTTP Gzip decompressed data Type 5: SMTP filename Type 6: SMTP MAIL FROM addresses Type 7: SMTP RCPT TO addresses Type 8: SMTP Email headers Type 9: HTTP Request URI Type 10: HTTP Request Hostname Type 11: Packet's IPv6 Source IP Address Type 12: Packet's IPv6 Destination IP Address
Attributes
Build methods defaults
Build methods defaults
Build methods defaults
Build methods defaults
Build methods defaults
Build methods defaults
Build methods defaults
Build methods defaults
Public Class Methods
Initialize Extra
object
@param [Hash] data Extra
data hash
# File lib/unified2/extra.rb, line 85 def initialize(data) extra = data[:data] @header = extra[:header] @data = extra[:data] @timestamp = Time.at(@data[:event_second].to_i) @value = @data[:blob].to_s @length = @data[:blob_length].to_i @type_id = @data[:extra_type].to_i @data_type = @data[:data_type].to_i @type = EXTRA_TYPES[@type_id.to_i] end
Public Instance Methods
Blank?
@return [true, false] Check is extra value is blank
# File lib/unified2/extra.rb, line 103 def blank? return true unless @value false end
Description
@return [String] Extra
data description
# File lib/unified2/extra.rb, line 113 def description @type.last end
Name
@return [String] Extra
data name
# File lib/unified2/extra.rb, line 122 def name @type.first end
# File lib/unified2/extra.rb, line 126 def to_h to_h = { :value => value, :header => { :type => header[:event_type], :length => header[:event_length], }, :length => length, :name => name, :description => description, :timestamp => timestamp.to_s, :type_id => type_id, :data_type => data_type } end