Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion demo.ts
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,8 @@ async function runDemo() {
console.log('Starting demo...')

process.env.ENVIRONMENT = 'demo-1'
process.env.ACCOUNT = 'demo'
process.env.AWS_ACCOUNT_NAME = 'demo'
process.env.AWS_ACCOUNT_ID = '987654321'

const event = anApplicationLogCloudWatchEvent.input
event.records = [
Expand Down
4 changes: 2 additions & 2 deletions spec/fixtures/cloudtrail_fixtures.ts
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ export const aCloudTrailLogCloudWatchEvent: Fixture = {
recordId: 'LogEvent-1',
data: Buffer.from([
{
host: 'test',
host: '223851549868',
source: 'cloudtrail',
sourcetype: 'aws:cloudtrail',
index: 'pay_platform',
Expand All @@ -46,7 +46,7 @@ export const aCloudTrailLogCloudWatchEvent: Fixture = {
time: 1739979788.000
},
{
host: 'test',
host: '223851549868',
source: 'cloudtrail',
sourcetype: 'aws:cloudtrail',
index: 'pay_platform',
Expand Down
20 changes: 15 additions & 5 deletions spec/index.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,8 @@ import {
import { SplunkRecord } from '../src/types'

process.env.ENVIRONMENT = 'test-12'
process.env.ACCOUNT = 'test'
process.env.AWS_ACCOUNT_NAME = 'test'
process.env.AWS_ACCOUNT_ID = '223851549868'

describe('Processing CloudWatchLogEvents', () => {
describe('From Applications', () => {
Expand Down Expand Up @@ -457,14 +458,23 @@ describe('General processing', () => {
})

test('should error if ENVIRONMENT env var is not set', async () => {
process.env.ACCOUNT = 'test'
process.env.AWS_ACCOUNT_NAME = 'test'
process.env.AWS_ACCOUNT_ID = '223851549868'
process.env.ENVIRONMENT = ''
await expect(async () => await handler(aCloudWatchEventWith([]), mockContext, mockCallback) as FirehoseTransformationResult).rejects.toThrow('"ENVIRONMENT" env var is not set')
})

test('should error if ACCOUNT env var is not set', async () => {
test('should error if AWS_ACCOUNT_NAME env var is not set', async () => {
process.env.ENVIRONMENT = 'test-12'
process.env.ACCOUNT = ''
await expect(async () => await handler(aCloudWatchEventWith([]), mockContext, mockCallback) as FirehoseTransformationResult).rejects.toThrow('"ACCOUNT" env var is not set')
process.env.AWS_ACCOUNT_ID = '223851549868'
process.env.AWS_ACCOUNT_NAME = ''
await expect(async () => await handler(aCloudWatchEventWith([]), mockContext, mockCallback) as FirehoseTransformationResult).rejects.toThrow('"AWS_ACCOUNT_NAME" env var is not set')
})

test('should error if AWS_ACCOUNT_ID env var is not set', async () => {
process.env.ENVIRONMENT = 'test-12'
process.env.AWS_ACCOUNT_NAME = 'test'
process.env.AWS_ACCOUNT_ID = ''
await expect(async () => await handler(aCloudWatchEventWith([]), mockContext, mockCallback) as FirehoseTransformationResult).rejects.toThrow('"AWS_ACCOUNT_ID" env var is not set')
})
})
3 changes: 2 additions & 1 deletion src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ function getMandatoryEnvVar(varName: string): string {
function getEnvVars(): EnvVars {
return {
environment: getMandatoryEnvVar('ENVIRONMENT'),
account: getMandatoryEnvVar('ACCOUNT')
aws_account_name: getMandatoryEnvVar('AWS_ACCOUNT_NAME'),
aws_account_id: getMandatoryEnvVar('AWS_ACCOUNT_ID')
}
}

Expand Down
8 changes: 4 additions & 4 deletions src/transformData.ts
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ function transformALBLog(data: S3LogRecord, envVars: EnvVars, approximateArrival
index: 'pay_ingress',
event: log,
fields: {
account: envVars.account,
account: envVars.aws_account_name,
environment: envVars.environment,
service: getAlbService(data.ALB as string, envVars.environment)
},
Expand Down Expand Up @@ -65,7 +65,7 @@ function transformS3AccessLog(data: S3LogRecord, envVars: EnvVars, approximateAr
index: 'pay_storage',
event: log,
fields: {
account: envVars.account,
account: envVars.aws_account_name,
environment: envVars.environment
},
time
Expand All @@ -89,10 +89,10 @@ function transformCloudWatchData(data: CloudWatchLogsDecodedData, envVars: EnvVa
validateLogGroup(data.logGroup)

const logType: CloudWatchLogTypes = getLogTypeFromLogGroup(data.logGroup)
const host = logType === CloudWatchLogTypes['cloudtrail'] ? envVars.account : data.logStream
const host = logType === CloudWatchLogTypes['cloudtrail'] ? envVars.aws_account_id : data.logStream
const source = CloudWatchLogTypes[logType]
const index = indexFromLogType(logType)
const account = envVars.account
const account = envVars.aws_account_name
const fields: SplunkFields = {
account
}
Expand Down
3 changes: 2 additions & 1 deletion src/types.ts
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,8 @@ export type S3LogRecord = {

export type EnvVars = {
environment: string
account: string
aws_account_name: string
aws_account_id: string
}

export enum CloudWatchLogTypes {
Expand Down