From ca87b79617c4b302cec7908ab1c1cdc3a7ac2537 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Wed, 24 Aug 2022 19:37:58 +0530 Subject: [PATCH 1/3] case with single string but multiple rel --- x-pack/filebeat/input/httpjson/value_tpl.go | 13 +++- .../filebeat/input/httpjson/value_tpl_test.go | 73 ++++++++++++++++++- 2 files changed, 82 insertions(+), 4 deletions(-) diff --git a/x-pack/filebeat/input/httpjson/value_tpl.go b/x-pack/filebeat/input/httpjson/value_tpl.go index a217d46343c..1b8417bd278 100644 --- a/x-pack/filebeat/input/httpjson/value_tpl.go +++ b/x-pack/filebeat/input/httpjson/value_tpl.go @@ -211,8 +211,8 @@ func parseTimestampNano(ns int64) time.Time { var regexpLinkRel = regexp.MustCompile(`<(.*)>;.*\srel\="?([^;"]*)`) -func getRFC5988Link(rel string, links []string) string { - for _, link := range links { +func getMatchLink(rel string, linksSplit []string) string { + for _, link := range linksSplit { if !regexpLinkRel.MatchString(link) { continue } @@ -228,10 +228,17 @@ func getRFC5988Link(rel string, links []string) string { return matches[1] } - return "" } +func getRFC5988Link(rel string, links []string) string { + if len(links) == 1 && strings.Count(links[0], "rel=") > 1 { + linksSplit := strings.Split(links[0], ",") + return getMatchLink(rel, linksSplit) + } + return getMatchLink(rel, links) +} + func toInt(v interface{}) int64 { vv := reflect.ValueOf(v) switch vv.Kind() { diff --git a/x-pack/filebeat/input/httpjson/value_tpl_test.go b/x-pack/filebeat/input/httpjson/value_tpl_test.go index aa5b27385b7..c55d16df028 100644 --- a/x-pack/filebeat/input/httpjson/value_tpl_test.go +++ b/x-pack/filebeat/input/httpjson/value_tpl_test.go @@ -189,7 +189,24 @@ func TestValueTpl(t *testing.T) { expectedVal: "2020-11-05 13:25:32 +0000 UTC", }, { - name: "func getRFC5988Link", + name: "func getRFC5988Link single rel matches", + value: `[[ getRFC5988Link "next" .last_response.header.Link ]]`, + paramCtx: &transformContext{ + firstEvent: &mapstr.M{}, + lastEvent: &mapstr.M{}, + lastResponse: newTestResponse( + nil, + http.Header{"Link": []string{ + `; title="Page 3"; rel="next"`, + }}, + "", + ), + }, + paramTr: transformable{}, + expectedVal: "https://example.com/api/v1/users?after=00ubfjQEMYBLRUWIEDKK", + }, + { + name: "func getRFC5988Link multiple rel as seperate strings matches", value: `[[ getRFC5988Link "previous" .last_response.header.Link ]]`, paramCtx: &transformContext{ firstEvent: &mapstr.M{}, @@ -206,6 +223,60 @@ func TestValueTpl(t *testing.T) { paramTr: transformable{}, expectedVal: "https://example.com/api/v1/users?before=00ubfjQEMYBLRUWIEDKK", }, + { + name: "func getRFC5988Link multiple rel as seperate strings in random order matches", + value: `[[ getRFC5988Link "previous" .last_response.header.Link ]]`, + paramCtx: &transformContext{ + firstEvent: &mapstr.M{}, + lastEvent: &mapstr.M{}, + lastResponse: newTestResponse( + nil, + http.Header{"Link": []string{ + `; title="Page 1"; rel="previous"`, + `; title="Page 3"; rel="next"`, + }}, + "", + ), + }, + paramTr: transformable{}, + expectedVal: "https://example.com/api/v1/users?before=00ubfjQEMYBLRUWIEDKK", + }, + { + name: "func getRFC5988Link multiple rel as single string matches", + value: `[[ getRFC5988Link "previous" .last_response.header.Link ]]`, + paramCtx: &transformContext{ + firstEvent: &mapstr.M{}, + lastEvent: &mapstr.M{}, + lastResponse: newTestResponse( + nil, + http.Header{"Link": []string{ + `; title="Page 1"; rel="previous", + ; title="Page 3"; rel="next"`, + }}, + "", + ), + }, + paramTr: transformable{}, + expectedVal: "https://example.com/api/v1/users?before=00ubfjQEMYBLRUWIEDKK", + }, + { + name: "func getRFC5988Link multiple rel as single string in random order matches", + value: `[[ getRFC5988Link "next" .last_response.header.Link ]]`, + paramCtx: &transformContext{ + firstEvent: &mapstr.M{}, + lastEvent: &mapstr.M{}, + lastResponse: newTestResponse( + nil, + http.Header{"Link": []string{ + `; title="Page 1"; rel="previous", + ; title="Page 3"; rel="next"`, + }}, + "", + ), + }, + paramTr: transformable{}, + expectedVal: "https://example.com/api/v1/users?after=00ubfjQEMYBLRUWIEDKK", + }, { name: "func getRFC5988Link does not match", value: `[[ getRFC5988Link "previous" .last_response.header.Link ]]`, From badcf02ddef7c0affae661ec14c79ecab8f913a9 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Wed, 24 Aug 2022 20:45:54 +0530 Subject: [PATCH 2/3] misspell lint error --- x-pack/filebeat/input/httpjson/value_tpl_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/x-pack/filebeat/input/httpjson/value_tpl_test.go b/x-pack/filebeat/input/httpjson/value_tpl_test.go index 6d80773c874..5bdc92f939c 100644 --- a/x-pack/filebeat/input/httpjson/value_tpl_test.go +++ b/x-pack/filebeat/input/httpjson/value_tpl_test.go @@ -206,7 +206,7 @@ func TestValueTpl(t *testing.T) { expectedVal: "https://example.com/api/v1/users?after=00ubfjQEMYBLRUWIEDKK", }, { - name: "func getRFC5988Link multiple rel as seperate strings matches", + name: "func getRFC5988Link multiple rel as separate strings matches", value: `[[ getRFC5988Link "previous" .last_response.header.Link ]]`, paramCtx: &transformContext{ firstEvent: &mapstr.M{}, @@ -224,7 +224,7 @@ func TestValueTpl(t *testing.T) { expectedVal: "https://example.com/api/v1/users?before=00ubfjQEMYBLRUWIEDKK", }, { - name: "func getRFC5988Link multiple rel as seperate strings in random order matches", + name: "func getRFC5988Link multiple rel as separate strings in random order matches", value: `[[ getRFC5988Link "previous" .last_response.header.Link ]]`, paramCtx: &transformContext{ firstEvent: &mapstr.M{}, From 2aa31186bc8a0f6a491e941b9b47354a46f6981e Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 25 Aug 2022 18:06:45 +0530 Subject: [PATCH 3/3] Add ascii doc --- CHANGELOG.next.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 22867bc9ae8..d4a4d123488 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -137,6 +137,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff] - add documentation for decode_xml_wineventlog processor field mappings. {pull}32456[32456] - httpjson input: Add request tracing logger. {issue}32402[32402] {pull}32412[32412] - Add cloudflare R2 to provider list in AWS S3 input. {pull}32620[32620] +- Add support for single string containing multiple relation-types in getRFC5988Link. {pull}32811[32811] *Auditbeat*