Manage the event lifecycle a little more tightly

This prevents us from needing to return a copy or from needing to put
the maps in an unmodifiable wrapper. The object is single use: you
build it, get the maps, close it, and then you're done.

Author: joegallo

modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java

@@ -26,7 +26,6 @@
 import java.time.temporal.TemporalAccessor;
 import java.time.temporal.WeekFields;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -533,9 +532,9 @@ private static String desanitizeExtensionVal(String value) {
         return desanitized;
     }
 
-    public static class CEFEvent {
-        private final Map<String, Object> rootMappings = new HashMap<>();
-        private final Map<String, Object> cefMappings = new HashMap<>();
+    public static class CEFEvent implements AutoCloseable {
+        private Map<String, Object> rootMappings = new HashMap<>();
+        private Map<String, Object> cefMappings = new HashMap<>();
 
         public void addRootMapping(String key, Object value) {
             this.rootMappings.put(key, value);
@@ -546,11 +545,21 @@ public void addCefMapping(String key, Object value) {
         }
 
         public Map<String, Object> getRootMappings() {
-            return Collections.unmodifiableMap(rootMappings);
+            return Objects.requireNonNull(rootMappings);
         }
 
         public Map<String, Object> getCefMappings() {
-            return Collections.unmodifiableMap(cefMappings);
+            return Objects.requireNonNull(cefMappings);
+        }
+
+        /**
+         * Nulls out the maps of the event so that future calls to methods of this class will fail with a
+         * {@link NullPointerException}.
+         */
+        @Override
+        public void close() {
+            this.rootMappings = null;
+            this.cefMappings = null;
         }
     }
 

modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefProcessor.java

@@ -59,10 +59,10 @@ public IngestDocument execute(IngestDocument document) {
             throw new IllegalArgumentException("field [" + field + "] is null, cannot process it.");
         }
         ZoneId timezone = getTimezone(document);
-        CEFEvent event = new CefParser(timezone, removeEmptyValue).process(line);
-        // Update ingestDocument with the CEF mappings
-        document.setFieldValue(targetField, event.getCefMappings());
-        event.getRootMappings().forEach(document::setFieldValue);
+        try (CEFEvent event = new CefParser(timezone, removeEmptyValue).process(line)) {
+            document.setFieldValue(targetField, event.getCefMappings());
+            event.getRootMappings().forEach(document::setFieldValue);
+        }
         return document;
     }