Show which fields matched
This commit is contained in:
parent
dd4b2ddd3a
commit
158fffed99
|
@ -17,14 +17,14 @@ from core.util import logs
|
|||
log = logs.get_logger("rules")
|
||||
|
||||
|
||||
def rule_matched(rule, message, matched_fields):
|
||||
def rule_matched(rule, message, matched):
|
||||
title = f"Rule {rule.name} matched"
|
||||
|
||||
# Dump the message in YAML for readability
|
||||
message = dump(message, Dumper=Dumper, default_flow_style=False)
|
||||
matched_fields = ", ".join(matched_fields)
|
||||
matched = ", ".join([f"{k}: {v}" for k, v in matched.items()])
|
||||
|
||||
notify_message = f"{rule.name} matched on {matched_fields}\n{message}"
|
||||
notify_message = f"{rule.name} match: {matched}\n{message}"
|
||||
notify_message = notify_message.encode("utf-8", "replace")
|
||||
|
||||
cast = {
|
||||
|
@ -43,6 +43,7 @@ def process_rules(data):
|
|||
for message in index_messages:
|
||||
for rule in all_rules:
|
||||
parsed_rule = rule.parse()
|
||||
matched = {}
|
||||
if "index" not in parsed_rule:
|
||||
continue
|
||||
if "source" not in parsed_rule:
|
||||
|
@ -58,9 +59,11 @@ def process_rules(data):
|
|||
if message["src"] not in rule_source:
|
||||
continue
|
||||
|
||||
matched["index"] = index
|
||||
matched["source"] = message["src"]
|
||||
|
||||
rule_field_length = len(parsed_rule.keys())
|
||||
matched_field_number = 0
|
||||
matched_fields = []
|
||||
for field, value in parsed_rule.items():
|
||||
if not type(value) == list:
|
||||
value = [value]
|
||||
|
@ -71,7 +74,7 @@ def process_rules(data):
|
|||
if "tokens" in message:
|
||||
if token in message["tokens"]:
|
||||
matched_field_number += 1
|
||||
matched_fields.append(field)
|
||||
matched[field] = token
|
||||
# Break out of the token matching loop
|
||||
break
|
||||
# Continue to next field
|
||||
|
@ -83,16 +86,16 @@ def process_rules(data):
|
|||
if "msg" in message:
|
||||
if msg.lower() in message["msg"].lower():
|
||||
matched_field_number += 1
|
||||
matched_fields.append(field)
|
||||
matched[field] = msg
|
||||
# Break out of the msg matching loop
|
||||
break
|
||||
# Continue to next field
|
||||
continue
|
||||
if field in message and message[field] in value:
|
||||
matched_field_number += 1
|
||||
matched_fields.append(field)
|
||||
matched[field] = message[field]
|
||||
if matched_field_number == rule_field_length - 2:
|
||||
rule_matched(rule, message, matched_fields)
|
||||
rule_matched(rule, message, matched)
|
||||
|
||||
|
||||
class NotificationRuleData(object):
|
||||
|
|
Loading…
Reference in New Issue