diff --git a/src/Nest/Ingest/ProcessorFormatter.cs b/src/Nest/Ingest/ProcessorFormatter.cs index b127b45a464..d4728199e3d 100644 --- a/src/Nest/Ingest/ProcessorFormatter.cs +++ b/src/Nest/Ingest/ProcessorFormatter.cs @@ -47,7 +47,8 @@ internal class ProcessorFormatter : IJsonFormatter { "enrich", 31 }, { "csv", 32 }, { "uri_parts", 33 }, - { "fingerprint", 34 } + { "fingerprint", 34 }, + { "community_id", 35 } }; public IProcessor Deserialize(ref JsonReader reader, IJsonFormatterResolver formatterResolver) @@ -173,6 +174,9 @@ public IProcessor Deserialize(ref JsonReader reader, IJsonFormatterResolver form case 34: processor = Deserialize(ref reader, formatterResolver); break; + case 35: + processor = Deserialize(ref reader, formatterResolver); + break; } } else @@ -299,6 +303,9 @@ public void Serialize(ref JsonWriter writer, IProcessor value, IJsonFormatterRes case "fingerprint": Serialize(ref writer, value, formatterResolver); break; + case "community_id": + Serialize(ref writer, value, formatterResolver); + break; default: var formatter = DynamicObjectResolver.ExcludeNullCamelCase.GetFormatter(); formatter.Serialize(ref writer, value, formatterResolver); diff --git a/src/Nest/Ingest/Processors/NetworkCommunityIdProcessor.cs b/src/Nest/Ingest/Processors/NetworkCommunityIdProcessor.cs new file mode 100644 index 00000000000..a4038981112 --- /dev/null +++ b/src/Nest/Ingest/Processors/NetworkCommunityIdProcessor.cs @@ -0,0 +1,171 @@ +using System; +using System.Linq.Expressions; +using System.Runtime.Serialization; +using Elasticsearch.Net.Utf8Json; + +namespace Nest +{ + [InterfaceDataContract] + public interface INetworkCommunityIdProcessor : IProcessor + { + [DataMember(Name = "destination_ip")] + Field DestinationIp { get; set; } + + [DataMember(Name = "destination_port")] + Field DestinationPort { get; set; } + + [DataMember(Name = "iana_number")] + Field IanaNumber { get; set; } + + [DataMember(Name = "icmp_type")] + Field IcmpType { get; set; } + + [DataMember(Name = "icmp_code")] + Field IcmpCode { get; set; } + + [DataMember(Name = "ignore_missing")] + bool? IgnoreMissing { get; set; } + + [DataMember(Name = "seed")] + int? Seed { get; set; } + + [DataMember(Name = "source_ip")] + Field SourceIp { get; set; } + + [DataMember(Name = "source_port")] + Field SourcePort { get; set; } + + [DataMember(Name = "target_field")] + Field TargetField { get; set; } + + [DataMember(Name = "transport")] + Field Transport { get; set; } + } + + public class NetworkCommunityIdProcessor : ProcessorBase, INetworkCommunityIdProcessor + { + protected override string Name => "community_id"; + + /// + public Field DestinationIp { get; set; } + /// + public Field DestinationPort { get; set; } + /// + public Field IanaNumber { get; set; } + /// + public Field IcmpType { get; set; } + /// + public Field IcmpCode { get; set; } + /// + public bool? IgnoreMissing { get; set; } + /// + public int? Seed { get; set; } + /// + public Field SourceIp { get; set; } + /// + public Field SourcePort { get; set; } + /// + public Field TargetField { get; set; } + /// + public Field Transport { get; set; } + } + + /// + public class NetworkCommunityIdProcessorDescriptor + : ProcessorDescriptorBase, INetworkCommunityIdProcessor>, INetworkCommunityIdProcessor + where T : class + { + protected override string Name => "community_id"; + + Field INetworkCommunityIdProcessor.DestinationIp { get; set; } + + Field INetworkCommunityIdProcessor.DestinationPort { get; set; } + + Field INetworkCommunityIdProcessor.IanaNumber { get; set; } + + Field INetworkCommunityIdProcessor.IcmpType { get; set; } + + Field INetworkCommunityIdProcessor.IcmpCode { get; set; } + + bool? INetworkCommunityIdProcessor.IgnoreMissing { get; set; } + + int? INetworkCommunityIdProcessor.Seed { get; set; } + + Field INetworkCommunityIdProcessor.SourceIp { get; set; } + + Field INetworkCommunityIdProcessor.SourcePort { get; set; } + + Field INetworkCommunityIdProcessor.TargetField { get; set; } + + Field INetworkCommunityIdProcessor.Transport { get; set; } + + /// + public NetworkCommunityIdProcessorDescriptor DestinationIp(Field field) => Assign(field, (a, v) => a.DestinationIp = v); + + /// + public NetworkCommunityIdProcessorDescriptor DestinationIp(Expression> objectPath) => + Assign(objectPath, (a, v) => a.DestinationIp = v); + + /// + public NetworkCommunityIdProcessorDescriptor DestinationPort(Field field) => Assign(field, (a, v) => a.DestinationPort = v); + + /// + public NetworkCommunityIdProcessorDescriptor DestinationPort(Expression> objectPath) => + Assign(objectPath, (a, v) => a.DestinationPort = v); + + /// + public NetworkCommunityIdProcessorDescriptor IanaNumber(Field field) => Assign(field, (a, v) => a.IanaNumber = v); + + /// + public NetworkCommunityIdProcessorDescriptor IanaNumber(Expression> objectPath) => + Assign(objectPath, (a, v) => a.IanaNumber = v); + + /// + public NetworkCommunityIdProcessorDescriptor IcmpType(Field field) => Assign(field, (a, v) => a.IcmpType = v); + + /// + public NetworkCommunityIdProcessorDescriptor IcmpType(Expression> objectPath) => + Assign(objectPath, (a, v) => a.IcmpType = v); + + /// + public NetworkCommunityIdProcessorDescriptor IcmpCode(Field field) => Assign(field, (a, v) => a.IcmpCode = v); + + /// + public NetworkCommunityIdProcessorDescriptor IcmpCode(Expression> objectPath) => + Assign(objectPath, (a, v) => a.IcmpCode = v); + + /// + public NetworkCommunityIdProcessorDescriptor IgnoreMissing(bool? ignoreMissing = true) => Assign(ignoreMissing, (a, v) => a.IgnoreMissing = v); + + /// + public NetworkCommunityIdProcessorDescriptor Seed(int? seed = null) => Assign(seed, (a, v) => a.Seed = v); + + /// + public NetworkCommunityIdProcessorDescriptor SourceIp(Field field) => Assign(field, (a, v) => a.SourceIp = v); + + /// + public NetworkCommunityIdProcessorDescriptor SourceIp(Expression> objectPath) => + Assign(objectPath, (a, v) => a.SourceIp = v); + + /// + public NetworkCommunityIdProcessorDescriptor SourcePort(Field field) => Assign(field, (a, v) => a.SourcePort = v); + + /// + public NetworkCommunityIdProcessorDescriptor SourcePort(Expression> objectPath) => + Assign(objectPath, (a, v) => a.SourcePort = v); + + /// + public NetworkCommunityIdProcessorDescriptor TargetField(Field field) => Assign(field, (a, v) => a.TargetField = v); + + /// + public NetworkCommunityIdProcessorDescriptor TargetField(Expression> objectPath) => + Assign(objectPath, (a, v) => a.TargetField = v); + + /// + public NetworkCommunityIdProcessorDescriptor Transport(Field field) => Assign(field, (a, v) => a.Transport = v); + + /// + public NetworkCommunityIdProcessorDescriptor Transport(Expression> objectPath) => + Assign(objectPath, (a, v) => a.Transport = v); + } +} diff --git a/src/Nest/Ingest/ProcessorsDescriptor.cs b/src/Nest/Ingest/ProcessorsDescriptor.cs index cdd0ea4ca00..d18c3836093 100644 --- a/src/Nest/Ingest/ProcessorsDescriptor.cs +++ b/src/Nest/Ingest/ProcessorsDescriptor.cs @@ -185,5 +185,9 @@ public ProcessorsDescriptor UriParts(Func, IUr /// public ProcessorsDescriptor Fingerprint(Func, IFingerprintProcessor> selector) where T : class => Assign(selector, (a, v) => a.AddIfNotNull(v?.Invoke(new FingerprintProcessorDescriptor()))); + + /// + public ProcessorsDescriptor NetworkCommunityId(Func, INetworkCommunityIdProcessor> selector) where T : class => + Assign(selector, (a, v) => a.AddIfNotNull(v?.Invoke(new NetworkCommunityIdProcessorDescriptor()))); } } diff --git a/tests/Tests/Ingest/ProcessorAssertions.cs b/tests/Tests/Ingest/ProcessorAssertions.cs index b844a86043a..3207ca21c26 100644 --- a/tests/Tests/Ingest/ProcessorAssertions.cs +++ b/tests/Tests/Ingest/ProcessorAssertions.cs @@ -12,6 +12,7 @@ using Tests.Core.Extensions; using Tests.Core.Xunit; using Tests.Domain; +using static Nest.Infer; namespace Tests.Ingest { @@ -189,7 +190,7 @@ public class Enrich : ProcessorAssertion public override IProcessor Initializer => new EnrichProcessor { PolicyName = PolicyName, - Field = Infer.Field(f => f.Name), + Field = Field(f => f.Name), TargetField = "target_field" }; @@ -226,7 +227,7 @@ public class Foreach : ProcessorAssertion public override IProcessor Initializer => new ForeachProcessor { - Field = Infer.Field(p => p.Tags), + Field = Field(p => p.Tags), Processor = new UppercaseProcessor { Field = "_value.name" @@ -360,7 +361,7 @@ public class Set : ProcessorAssertion public override Func>> Fluent => d => d.Set(s => s.Field(p => p.Name).Value("foo")); - public override IProcessor Initializer => new SetProcessor { Field = Infer.Field(p => p.Name), Value = "foo" }; + public override IProcessor Initializer => new SetProcessor { Field = Field(p => p.Name), Value = "foo" }; public override object Json => new { field = "name", value = "foo" }; public override string Key => "set"; @@ -732,5 +733,55 @@ public class Fingerprint : ProcessorAssertion public override object Json => new { fields = new[] { "labels" }, method = "MD5", salt = "ThisIsASalt!", target_field = "description", ignore_missing = true }; public override string Key => "fingerprint"; } + + [SkipVersion("<7.12.0", "Uses the network community ID processor which was introduced in 7.12.0")] + public class NetworkCommunityId : ProcessorAssertion + { + public override Func>> Fluent => d => d + .NetworkCommunityId(ud => ud + .DestinationIp(f => f.LeadDeveloper.IpAddress) + .DestinationPort("leadDeveloper.portNumber") + .IanaNumber(f => f.Name) + .IcmpType(f => f.Name) + .IcmpCode(f => f.Name) + .IgnoreMissing() + .Seed(100) + .SourceIp(f => f.LeadDeveloper.IpAddress) + .SourcePort("leadDeveloper.portNumber") + .TargetField(f => f.Description) + .Transport(f => f.Name)); + + public override IProcessor Initializer => new NetworkCommunityIdProcessor + { + DestinationIp = Field(f => f.LeadDeveloper.IpAddress), + DestinationPort = "leadDeveloper.portNumber", + IanaNumber = "name", + IcmpType = "name", + IcmpCode = "name", + IgnoreMissing = true, + Seed = 100, + SourceIp = Field(f => f.LeadDeveloper.IpAddress), + SourcePort = "leadDeveloper.portNumber", + TargetField = "description", + Transport = "name" + }; + + public override object Json => new + { + destination_ip = "leadDeveloper.ipAddress", + destination_port = "leadDeveloper.portNumber", + iana_number = "name", + icmp_code = "name", + icmp_type = "name", + ignore_missing = true, + seed = 100, + source_ip = "leadDeveloper.ipAddress", + source_port = "leadDeveloper.portNumber", + target_field = "description", + transport = "name" + }; + + public override string Key => "community_id"; + } } }