.put(MetronRestConstants.GROK_PATH_KEY, new Path(temporaryGrokPath, name).toString()); parser.configure(sensorParserConfig.getParserConfig()); parser.init(); Optional<MessageParserResult<JSONObject>> result = parser.parseOptionalResult(parseMessageRequest.getSampleData().getBytes()); if (!result.isPresent()) { throw new RestException("Unknown error parsing sample data");
/** * Take raw data and convert it to an optional list of messages. * @param parseMessage the raw bytes of the message * @return If null is returned, this is treated as an empty list. */ @Deprecated default Optional<List<T>> parseOptional(byte[] parseMessage) { return Optional.ofNullable(parse(parseMessage)); }
/** * Take raw data and convert it to messages. Each raw message may produce multiple messages and therefore * multiple errors. A {@link MessageParserResult} is returned, which will have both the messages produced * and the errors. * @param parseMessage the raw bytes of the message * @return Optional of {@link MessageParserResult} */ default Optional<MessageParserResult<T>> parseOptionalResult(byte[] parseMessage) { Optional<MessageParserResult<T>> result = Optional.empty(); try { Optional<List<T>> optionalMessages = parseOptional(parseMessage); if (optionalMessages.isPresent()) { result = Optional.of(new DefaultMessageParserResult<>(optionalMessages.get())); } } catch (Throwable t) { return Optional.of(new DefaultMessageParserResult<>(t)); } return result; }
@Test public void testNullable() throws Exception { MessageParser parser = new TestMessageParser() { @Override public List<JSONObject> parse(byte[] rawMessage) { return null; } }; Assert.assertNotNull(parser.parseOptionalResult(null)); Assert.assertFalse(parser.parseOptionalResult(null).isPresent()); }
boolean isInvalid = !parser.validate(message); List<FieldValidator> failedValidators = null; if (!isInvalid) {
{ MessageParser parser = new MessageParser(); for (int i = 0; i < 10000; i++) { parser.parse(plainMessage, user); } } // `parser` no longer visible
@Test public void testNotNullable() throws Exception { MessageParser<JSONObject> parser = new TestMessageParser() { @Override public List<JSONObject> parse(byte[] rawMessage) { return new ArrayList<>(); } }; Assert.assertNotNull(parser.parseOptionalResult(null)); Optional<MessageParserResult<JSONObject>> ret = parser.parseOptionalResult(null); Assert.assertTrue(ret.isPresent()); Assert.assertEquals(0, ret.get().getMessages().size()); }
Assert.assertEquals(broParser, broComponent.getMessageParser()); Assert.assertEquals(stellarFilter, broComponent.getFilter()); verify(broParser, times(1)).init(); verify(broParser, times(1)).configure(broParserConfig); verifyNoMoreInteractions(broParser); verifyNoMoreInteractions(stellarFilter); Assert.assertEquals(snortParser, snortComponent.getMessageParser()); Assert.assertNull(snortComponent.getFilter()); verify(snortParser, times(1)).init(); verify(snortParser, times(1)).configure(snortParserConfig); verifyNoMoreInteractions(snortParser);
@Test public void shouldPopulateMessagesOnProcessMessage() { JSONObject inputMessage = new JSONObject(); inputMessage.put("guid", "guid"); inputMessage.put("ip_src_addr", "192.168.1.1"); inputMessage.put("ip_dst_addr", "192.168.1.2"); inputMessage.put("field1", "value"); RawMessage rawMessage = new RawMessage("raw_message".getBytes(), new HashMap<>()); JSONObject expectedOutput = new JSONObject(); expectedOutput.put("guid", "guid"); expectedOutput.put("source.type", "bro"); expectedOutput.put("ip_src_addr", "192.168.1.1"); expectedOutput.put("ip_dst_addr", "192.168.1.2"); when(stellarFilter.emit(expectedOutput, parserRunner.getStellarContext())).thenReturn(true); when(broParser.validate(expectedOutput)).thenReturn(true); parserRunner.setSensorToParserComponentMap(new HashMap<String, ParserComponent>() {{ put("bro", new ParserComponent(broParser, stellarFilter)); }}); Optional<ParserRunnerImpl.ProcessResult> processResult = parserRunner.processMessage("bro", inputMessage, rawMessage, broParser, parserConfigurations); Assert.assertTrue(processResult.isPresent()); Assert.assertFalse(processResult.get().isError()); Assert.assertEquals(expectedOutput, processResult.get().getMessage()); }
@Test public void testParse() { JSONObject message = new JSONObject(); MessageParser<JSONObject> parser = new TestMessageParser() { @Override public List<JSONObject> parse(byte[] rawMessage) { return Collections.singletonList(message); } }; Optional<MessageParserResult<JSONObject>> ret = parser.parseOptionalResult("message".getBytes()); Assert.assertTrue(ret.isPresent()); Assert.assertEquals(1, ret.get().getMessages().size()); Assert.assertEquals(message, ret.get().getMessages().get(0)); }
when(broParser.validate(expectedOutput)).thenReturn(true);
@Test public void testParseOptional() { JSONObject message = new JSONObject(); MessageParser<JSONObject> parser = new TestMessageParser() { @Override public Optional<List<JSONObject>> parseOptional(byte[] rawMessage) { return Optional.of(Collections.singletonList(message)); } }; Optional<MessageParserResult<JSONObject>> ret = parser.parseOptionalResult("message".getBytes()); Assert.assertTrue(ret.isPresent()); Assert.assertEquals(1, ret.get().getMessages().size()); Assert.assertEquals(message, ret.get().getMessages().get(0)); }
@Test public void shouldReturnMetronErrorOnInvalidMessage() { JSONObject inputMessage = new JSONObject(); inputMessage.put("guid", "guid"); RawMessage rawMessage = new RawMessage("raw_message".getBytes(), new HashMap<>()); JSONObject expectedOutput = new JSONObject(); expectedOutput.put("guid", "guid"); expectedOutput.put("source.type", "bro"); MetronError expectedMetronError = new MetronError() .withErrorType(Constants.ErrorType.PARSER_INVALID) .withSensorType(Collections.singleton("bro")) .addRawMessage(inputMessage); when(stellarFilter.emit(expectedOutput, parserRunner.getStellarContext())).thenReturn(true); when(broParser.validate(expectedOutput)).thenReturn(false); parserRunner.setSensorToParserComponentMap(new HashMap<String, ParserComponent>() {{ put("bro", new ParserComponent(broParser, stellarFilter)); }}); Optional<ParserRunnerImpl.ProcessResult> processResult = parserRunner.processMessage("bro", inputMessage, rawMessage, broParser, parserConfigurations); Assert.assertTrue(processResult.isPresent()); Assert.assertTrue(processResult.get().isError()); Assert.assertEquals(expectedMetronError, processResult.get().getError()); }
@Test public void testParseException() { MessageParser<JSONObject> parser = new TestMessageParser() { @Override public List<JSONObject> parse(byte[] rawMessage) { throw new RuntimeException("parse exception"); } }; Optional<MessageParserResult<JSONObject>> ret = parser.parseOptionalResult("message".getBytes()); Assert.assertTrue(ret.isPresent()); Assert.assertTrue(ret.get().getMasterThrowable().isPresent()); Assert.assertEquals("parse exception", ret.get().getMasterThrowable().get().getMessage()); }
@Test public void testParseOptionalException() { MessageParser<JSONObject> parser = new TestMessageParser() { @Override public Optional<List<JSONObject>> parseOptional(byte[] rawMessage) { throw new RuntimeException("parse exception"); } }; Optional<MessageParserResult<JSONObject>> ret = parser.parseOptionalResult("message".getBytes()); Assert.assertTrue(ret.isPresent()); Assert.assertTrue(ret.get().getMasterThrowable().isPresent()); Assert.assertEquals("parse exception", ret.get().getMasterThrowable().get().getMessage()); }
if (sensorParserConfig != null) { MessageParser<JSONObject> parser = sensorToParserComponentMap.get(sensorType).getMessageParser(); Optional<MessageParserResult<JSONObject>> optionalMessageParserResult = parser.parseOptionalResult(rawMessage.getMessage()); if (optionalMessageParserResult.isPresent()) { MessageParserResult<JSONObject> messageParserResult = optionalMessageParserResult.get();
@Test public void shouldExecuteWithMasterThrowable() { parserRunner = spy(parserRunner); RawMessage rawMessage = new RawMessage("raw_message".getBytes(), new HashMap<>()); Throwable masterThrowable = mock(Throwable.class); MessageParserResult<JSONObject> messageParserResult = new DefaultMessageParserResult<>(masterThrowable); when(broParser.parseOptionalResult(rawMessage.getMessage())).thenReturn(Optional.of(messageParserResult)); parserRunner.setSensorToParserComponentMap(new HashMap<String, ParserComponent>() {{ put("bro", new ParserComponent(broParser, stellarFilter)); }}); ParserRunnerResults<JSONObject> parserRunnerResults = parserRunner.execute("bro", rawMessage, parserConfigurations); verify(parserRunner, times(0)) .processMessage(any(), any(), any(), any(), any()); MetronError expectedError = new MetronError() .withErrorType(Constants.ErrorType.PARSER_ERROR) .withThrowable(masterThrowable) .withSensorType(Collections.singleton("bro")) .addRawMessage(rawMessage.getMessage()); Assert.assertEquals(1, parserRunnerResults.getErrors().size()); Assert.assertTrue(parserRunnerResults.getErrors().contains(expectedError)); }
ProcessResult processedErrorResult = mock(ProcessResult.class); when(broParser.parseOptionalResult(rawMessage.getMessage())).thenReturn(Optional.of(messageParserResult)); when(processedMessageResult.getMessage()).thenReturn(processedMessage); when(processedErrorResult.isError()).thenReturn(true);