event.go

/*************************************************************************
 * Copyright 2023 Gravwell, Inc. All rights reserved.
 * Contact: <legal@gravwell.io>
 *
 * This software may be modified and distributed under the terms of the
 * BSD 2-clause license. See the LICENSE file for details.
 **************************************************************************/

package types

import (
	"time"

	"github.com/google/uuid"
)

type EventType string

const (
	EVENTTYPE_LOG   EventType = "log"
	EVENTTYPE_EVENT EventType = "event"

	EVENTLOG_LEVEL_DEBUG = "debug"
	EVENTLOG_LEVEL_INFO  = "info"
	EVENTLOG_LEVEL_WARN  = "warn"
	EVENTLOG_LEVEL_ERROR = "error"
)

// Event is the type produced by an Alert Dispatcher which gets ingested.
// The Type field should always be EVENTTYPE_EVENT, to indicate that this is a regular event.
type Event struct {
	Type     EventType
	Metadata EventMetadata          `json:",omitempty"`
	Contents map[string]interface{} `json:",omitempty"`
}

// EventLog gets generated when something happens during the execution of
// an alert that needs to be logged.
// The Type field should always be EVENTTYPE_LOG.
type EventLog struct {
	Type    EventType
	Level   string
	Message string            `json:",omitempty"`
	KV      map[string]string `json:",omitempty"`
	Trigger Event             `json:",omitempty"`
}

// EventMetadata tells us about the owner of this event definition and who created the event.
type EventMetadata struct {
	UID                int32
	Username           string
	Created            time.Time
	AlertID            string // ThingUUID of the Alert
	AlertName          string
	AlertActivation    string // uniquely identify the particular activation of the alert
	EventIndex         int    // this event's index within the dispatcher results for the alert activation
	TargetTag          string // the tag this got sent to
	AlertLabels        []string
	Dispatcher         EventDispatcherInfo
	Consumers          []EventConsumerInfo    `json:",omitempty"` // consmers which will be launched for this event
	UserMetadata       map[string]interface{} // this is arbitrary stuff that the user attached to the alert def.
	ValidationProblems []ValidationProblem    `json:",omitempty"`
}

// EventDispatcherInfo gives extended information about the thing which triggered the alert / created the event
type EventDispatcherInfo struct {
	Type         AlertDispatcherType
	ID           string
	Name         string   `json:",omitempty"`
	SearchID     string   `json:",omitempty"`
	Labels       []string // any labels attached to this dispatcher
	EventCount   int      // number of events that were generated by the dispatcher
	EventsElided bool     // true if we had to drop events because there were too many results
}

// EventConsumerInfo gives extended information about a consumer which will be launched to consume this event.
type EventConsumerInfo struct {
	Type   AlertConsumerType
	ID     string
	Name   string
	Labels []string `json:",omitempty"`
}

// ValidationProblem describes a field which was specified in the schema but is either:
// 1. Missing from the dispatcher's output, or
// 2. Unable to be converted to the type specified in the schema
type ValidationProblem struct {
	Name  string // the path in question
	Type  string // the type we were attempting to convert to
	Error string // A descriptive message as to what went wrong
}

// BuildEventMetadata builds up a generic EventMetadata to be used with
// events for a specific firing of the given Alert via the given Dispatcher.
func BuildEventMetadata(created time.Time, ud UserDetails, alertDef AlertDefinition, dispatcher EventDispatcherInfo) EventMetadata {
	meta := EventMetadata{
		UID:             ud.UID,
		Username:        ud.User,
		Created:         created,
		AlertID:         alertDef.ThingUUID.String(),
		AlertLabels:     alertDef.Labels,
		AlertName:       alertDef.Name,
		AlertActivation: uuid.New().String(),
		TargetTag:       alertDef.TargetTag,
		Dispatcher:      dispatcher,
		UserMetadata:    alertDef.UserMetadata,
	}
	if meta.AlertLabels == nil {
		meta.AlertLabels = []string{}
	}
	return meta
}