refact parse.go

Author: mmetc

cmd/crowdsec/parse.go

@@ -11,48 +11,66 @@ import (
 	"github.com/crowdsecurity/crowdsec/pkg/pipeline"
 )
 
+func parseEvent(
+	event pipeline.Event,
+	parserCTX parser.UnixParserCtx,
+	nodes []parser.Node,
+) *pipeline.Event {
+	if !event.Process {
+		return nil
+	}
+
+	// Application security engine is going to generate 2 events:
+        //   - one that is treated as a log and can go to scenarios
+        //   - another one that will go directly to LAPI
+	if event.Type == pipeline.APPSEC {
+		outputEventChan <- event
+		return nil
+	}
+
+	if event.Line.Module == "" {
+		log.Errorf("empty event.Line.Module field, the acquisition module must set it ! : %+v", event.Line)
+		return nil
+	}
+
+	metrics.GlobalParserHits.With(prometheus.Labels{"source": event.Line.Src, "type": event.Line.Module}).Inc()
+
+	startParsing := time.Now()
+	/* parse the log using magic */
+	parsed, err := parser.Parse(parserCTX, event, nodes)
+	if err != nil {
+		log.Errorf("failed parsing: %v", err)
+	}
+
+	elapsed := time.Since(startParsing)
+	metrics.GlobalParsingHistogram.With(prometheus.Labels{"source": event.Line.Src, "type": event.Line.Module}).Observe(elapsed.Seconds())
+	if !parsed.Process {
+		metrics.GlobalParserHitsKo.With(prometheus.Labels{"source": event.Line.Src, "type": event.Line.Module, "acquis_type": event.Line.Labels["type"]}).Inc()
+		log.Debugf("Discarding line %+v", parsed)
+		return nil
+	}
+
+	metrics.GlobalParserHitsOk.With(prometheus.Labels{"source": event.Line.Src, "type": event.Line.Module, "acquis_type": event.Line.Labels["type"]}).Inc()
+	if parsed.Whitelisted {
+		log.Debugf("event whitelisted, discard")
+		return nil
+	}
+
+	return &parsed
+}
+
 func runParse(input chan pipeline.Event, output chan pipeline.Event, parserCTX parser.UnixParserCtx, nodes []parser.Node) error {
 	for {
 		select {
 		case <-parsersTomb.Dying():
 			log.Infof("Killing parser routines")
 			return nil
 		case event := <-input:
-			if !event.Process {
-				continue
-			}
-			/*Application security engine is going to generate 2 events:
-			- one that is treated as a log and can go to scenarios
-			- another one that will go directly to LAPI*/
-			if event.Type == pipeline.APPSEC {
-				outputEventChan <- event
-				continue
-			}
-			if event.Line.Module == "" {
-				log.Errorf("empty event.Line.Module field, the acquisition module must set it ! : %+v", event.Line)
-				continue
-			}
-			metrics.GlobalParserHits.With(prometheus.Labels{"source": event.Line.Src, "type": event.Line.Module}).Inc()
-
-			startParsing := time.Now()
-			/* parse the log using magic */
-			parsed, err := parser.Parse(parserCTX, event, nodes)
-			if err != nil {
-				log.Errorf("failed parsing: %v", err)
-			}
-			elapsed := time.Since(startParsing)
-			metrics.GlobalParsingHistogram.With(prometheus.Labels{"source": event.Line.Src, "type": event.Line.Module}).Observe(elapsed.Seconds())
-			if !parsed.Process {
-				metrics.GlobalParserHitsKo.With(prometheus.Labels{"source": event.Line.Src, "type": event.Line.Module, "acquis_type": event.Line.Labels["type"]}).Inc()
-				log.Debugf("Discarding line %+v", parsed)
-				continue
-			}
-			metrics.GlobalParserHitsOk.With(prometheus.Labels{"source": event.Line.Src, "type": event.Line.Module, "acquis_type": event.Line.Labels["type"]}).Inc()
-			if parsed.Whitelisted {
-				log.Debugf("event whitelisted, discard")
+			parsed := parseEvent(event, parserCTX, nodes)
+			if parsed == nil {
 				continue
 			}
-			output <- parsed
+			output <- *parsed
 		}
 	}
 }