@@ -135,10 +135,18 @@ core::Property ConsumeWindowsEventLog::OutputFormat(
135135 core::PropertyBuilder::createProperty (" Output Format" )->
136136 isRequired(true )->
137137 withDefaultValue(Both)->
138- withAllowableValues<std::string>({XML, Plaintext, Both, JSONSimple, JSONFlattened, JSONRaw })->
138+ withAllowableValues<std::string>({XML, Plaintext, Both, JSON })->
139139 withDescription(" Set the output format type. In case \' Both\' is selected the processor generates two flow files for every event captured in format XML and Plaintext" )->
140140 build());
141141
142+ core::Property ConsumeWindowsEventLog::JSONFormat (
143+ core::PropertyBuilder::createProperty (" JSON Format" )->
144+ isRequired(true )->
145+ withDefaultValue(JSONSimple)->
146+ withAllowableValues<std::string>({JSONSimple, JSONFlattened, JSONRaw})->
147+ withDescription(" Set the json format type. Only applicable if Output Format is set to 'JSON'" )->
148+ build());
149+
142150core::Property ConsumeWindowsEventLog::BatchCommitSize (
143151 core::PropertyBuilder::createProperty (" Batch Commit Size" )->
144152 isRequired(false )->
@@ -198,7 +206,7 @@ void ConsumeWindowsEventLog::initialize() {
198206 // ! Set the supported properties
199207 setSupportedProperties ({
200208 Channel, Query, MaxBufferSize, InactiveDurationToReconnect, IdentifierMatcher, IdentifierFunction, ResolveAsAttributes,
201- EventHeaderDelimiter, EventHeader, OutputFormat, BatchCommitSize, BookmarkRootDirectory, ProcessOldEvents
209+ EventHeaderDelimiter, EventHeader, OutputFormat, JSONFormat, BatchCommitSize, BookmarkRootDirectory, ProcessOldEvents
202210 });
203211
204212 // ! Set the supported relationships
@@ -259,12 +267,16 @@ void ConsumeWindowsEventLog::onSchedule(const std::shared_ptr<core::ProcessConte
259267 } else if (mode == Both) {
260268 output_.xml = true ;
261269 output_.plaintext = true ;
262- } else if (mode == JSONRaw) {
263- output_.json .raw = true ;
264- } else if (mode == JSONSimple) {
265- output_.json .simple = true ;
266- } else if (mode == JSONFlattened) {
267- output_.json .flattened = true ;
270+ } else if (mode == JSON) {
271+ std::string json_format;
272+ context->getProperty (JSONFormat.getName (), json_format);
273+ if (json_format == JSONRaw) {
274+ output_.json .type = JSONType::Raw;
275+ } else if (json_format == JSONSimple) {
276+ output_.json .type = JSONType::Simple;
277+ } else if (json_format == JSONFlattened) {
278+ output_.json .type = JSONType::Flattened;
279+ }
268280 } else {
269281 // in the future this might be considered an error, but for now due to backwards
270282 // compatibility we just fall through and execute the processor outputing nothing
@@ -625,27 +637,17 @@ bool ConsumeWindowsEventLog::createEventRender(EVT_HANDLE hEvent, EventRender& e
625637 logger_->log_trace (" Finish writing in XML" );
626638 }
627639
628- if (output_.json .raw ) {
640+ if (output_.json .type == JSONType::Raw ) {
629641 logger_->log_trace (" Writing event in raw JSON" );
630-
631- eventRender.json .raw = wel::jsonToString (wel::toRawJSON (doc));
632-
642+ eventRender.json = wel::jsonToString (wel::toRawJSON (doc));
633643 logger_->log_trace (" Finish writing in raw JSON" );
634- }
635-
636- if (output_.json .simple ) {
644+ } else if (output_.json .type == JSONType::Simple) {
637645 logger_->log_trace (" Writing event in simple JSON" );
638-
639- eventRender.json .simple = wel::jsonToString (wel::toSimpleJSON (doc));
640-
646+ eventRender.json = wel::jsonToString (wel::toSimpleJSON (doc));
641647 logger_->log_trace (" Finish writing in simple JSON" );
642- }
643-
644- if (output_.json .flattened ) {
648+ } else if (output_.json .type == JSONType::Flattened) {
645649 logger_->log_trace (" Writing event in flattened JSON" );
646-
647- eventRender.json .flattened = wel::jsonToString (wel::toFlattenedJSON (doc));
648-
650+ eventRender.json = wel::jsonToString (wel::toFlattenedJSON (doc));
649651 logger_->log_trace (" Finish writing in flattened JSON" );
650652 }
651653
@@ -730,19 +732,15 @@ void ConsumeWindowsEventLog::putEventRenderFlowFileToSession(const EventRender&
730732 commitFlowFile (session.create (), eventRender.plaintext , " text/plain" );
731733 }
732734
733- if (output_.json .raw ) {
735+ if (output_.json .type == JSONType::Raw ) {
734736 logger_->log_trace (" Writing rendered raw JSON to a flow file" );
735- commitFlowFile (session.create (), eventRender.json .raw , " application/json" );
736- }
737-
738- if (output_.json .simple ) {
737+ commitFlowFile (session.create (), eventRender.json , " application/json" );
738+ } else if (output_.json .type == JSONType::Simple) {
739739 logger_->log_trace (" Writing rendered simple JSON to a flow file" );
740- commitFlowFile (session.create (), eventRender.json .simple , " application/json" );
741- }
742-
743- if (output_.json .flattened ) {
740+ commitFlowFile (session.create (), eventRender.json , " application/json" );
741+ } else if (output_.json .type == JSONType::Flattened) {
744742 logger_->log_trace (" Writing rendered flattened JSON to a flow file" );
745- commitFlowFile (session.create (), eventRender.json . flattened , " application/json" );
743+ commitFlowFile (session.create (), eventRender.json , " application/json" );
746744 }
747745}
748746
0 commit comments