98 lines
2.4 KiB
Go
98 lines
2.4 KiB
Go
|
package papertrail
|
||
|
|
|
||
|
|
import (
|
||
|
|
"encoding/json"
|
||
|
|
"fmt"
|
||
|
|
"net/http"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
"github.com/gorilla/mux"
|
||
|
|
|
||
|
|
"github.com/influxdata/telegraf"
|
||
|
|
"github.com/influxdata/telegraf/plugins/common/auth"
|
||
|
|
)
|
||
|
|
|
||
|
|
type Webhook struct {
|
||
|
|
Path string
|
||
|
|
acc telegraf.Accumulator
|
||
|
|
log telegraf.Logger
|
||
|
|
auth.BasicAuth
|
||
|
|
}
|
||
|
|
|
||
|
|
// Register registers the webhook with the provided router
|
||
|
|
func (pt *Webhook) Register(router *mux.Router, acc telegraf.Accumulator, log telegraf.Logger) {
|
||
|
|
router.HandleFunc(pt.Path, pt.eventHandler).Methods("POST")
|
||
|
|
pt.log = log
|
||
|
|
pt.log.Infof("Started the papertrail_webhook on %s", pt.Path)
|
||
|
|
pt.acc = acc
|
||
|
|
}
|
||
|
|
|
||
|
|
func (pt *Webhook) eventHandler(w http.ResponseWriter, r *http.Request) {
|
||
|
|
if r.Header.Get("Content-Type") != "application/x-www-form-urlencoded" {
|
||
|
|
http.Error(w, "Unsupported Media Type", http.StatusUnsupportedMediaType)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if !pt.Verify(r) {
|
||
|
|
w.WriteHeader(http.StatusUnauthorized)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
data := r.PostFormValue("payload")
|
||
|
|
if data == "" {
|
||
|
|
http.Error(w, "Bad Request", http.StatusBadRequest)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
var payload payload
|
||
|
|
err := json.Unmarshal([]byte(data), &payload)
|
||
|
|
if err != nil {
|
||
|
|
http.Error(w, "Bad Request", http.StatusBadRequest)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if payload.Events != nil {
|
||
|
|
// Handle event-based payload
|
||
|
|
for _, e := range payload.Events {
|
||
|
|
// Warning: Duplicate event timestamps will overwrite each other
|
||
|
|
tags := map[string]string{
|
||
|
|
"host": e.Hostname,
|
||
|
|
"event": payload.SavedSearch.Name,
|
||
|
|
}
|
||
|
|
fields := map[string]interface{}{
|
||
|
|
"count": uint64(1),
|
||
|
|
"id": e.ID,
|
||
|
|
"source_ip": e.SourceIP,
|
||
|
|
"source_name": e.SourceName,
|
||
|
|
"source_id": int64(e.SourceID),
|
||
|
|
"program": e.Program,
|
||
|
|
"severity": e.Severity,
|
||
|
|
"facility": e.Facility,
|
||
|
|
"message": e.Message,
|
||
|
|
"url": fmt.Sprintf("%s?centered_on_id=%d", payload.SavedSearch.SearchURL, e.ID),
|
||
|
|
"search_id": payload.SavedSearch.ID,
|
||
|
|
}
|
||
|
|
pt.acc.AddFields("papertrail", fields, tags, e.ReceivedAt)
|
||
|
|
}
|
||
|
|
} else if payload.Counts != nil {
|
||
|
|
// Handle count-based payload
|
||
|
|
for _, c := range payload.Counts {
|
||
|
|
for ts, count := range *c.TimeSeries {
|
||
|
|
tags := map[string]string{
|
||
|
|
"host": c.SourceName,
|
||
|
|
"event": payload.SavedSearch.Name,
|
||
|
|
}
|
||
|
|
fields := map[string]interface{}{
|
||
|
|
"count": count,
|
||
|
|
}
|
||
|
|
pt.acc.AddFields("papertrail", fields, tags, time.Unix(ts, 0))
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
http.Error(w, "Bad Request", http.StatusBadRequest)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
w.WriteHeader(http.StatusOK)
|
||
|
|
}
|