1 # Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
7 # http://www.apache.org/licenses/LICENSE-2.0
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
19 url => "${dmaap_base_url}/events/${event_topic}/${dmaap_consumer_group}/${dmaap_consumer_id}?timeout=15000"
21 Accept => "application/json"
23 topic => "${event_topic}"
24 tags => [ "dmaap_source" ]
26 notification_queue => {
28 url => "${dmaap_base_url}/events/${notification_topic}/${dmaap_consumer_group}/${dmaap_consumer_id}?timeout=15000"
30 Accept => "application/json"
32 topic => "${notification_topic}"
33 tags => [ "dmaap_source" ]
37 url => "${dmaap_base_url}/events/${request_topic}/${dmaap_consumer_group}/${dmaap_consumer_id}?timeout=15000"
39 Accept => "application/json"
41 topic => "${request_topic}"
42 tags => [ "dmaap_source" ]
47 schedule => { "every" => "1m" }
49 cacert => "/certs.d/aafca.pem"
55 # avoid noise if no entry in the list
56 if [message] == "[]" {
60 if [http_request_failure] or [@metadata][code] != 200 {
62 add_tag => [ "error" ]
66 if "dmaap_source" in [@metadata][request][tags] {
68 # Dmaap provides a json list, whose items are Strings containing the event
69 # provided to Dmaap, which itself is an escaped json.
71 # We first need to parse the json as we have to use the plaintext as it cannot
72 # work with list of events, then split that list into multiple string events,
73 # that we then transform into json.
82 # puts "\n======================================= MESSAGE"
83 # print event.get("message")
84 # puts "\n======================================= METADATA"
85 # print event.get("@metadata")
89 # for ev in event.get("message")
90 # puts "\n======================================= PARSED JSON EV"
91 # print JSON.parse(ev)
92 # puts "\n======================================= JSON EV"
93 # print JSON.parse(ev).get("@metadata")
95 # ev.set("[@metadata]", event.get("@metadata"))
107 remove_field => [ "message" ]
112 # Some timestamps are expressed as milliseconds, some are in microseconds
114 if [closedLoopAlarmStart] {
117 if event.get('closedLoopAlarmStart').to_s.to_i(10) > 9999999999999
118 event.set('closedLoopAlarmStart', event.get('closedLoopAlarmStart').to_s.to_i(10) / 1000)
120 event.set('closedLoopAlarmStart', event.get('closedLoopAlarmStart').to_s.to_i(10))
125 match => [ "closedLoopAlarmStart", UNIX_MS ]
126 target => "closedLoopAlarmStart"
130 if [closedLoopAlarmEnd] {
133 if event.get('closedLoopAlarmEnd').to_s.to_i(10) > 9999999999999
134 event.set('closedLoopAlarmEnd', event.get('closedLoopAlarmEnd').to_s.to_i(10) / 1000)
136 event.set('closedLoopAlarmEnd', event.get('closedLoopAlarmEnd').to_s.to_i(10))
141 match => [ "closedLoopAlarmEnd", UNIX_MS ]
142 target => "closedLoopAlarmEnd"
149 # Notification time are expressed under the form "yyyy-MM-dd HH:mm:ss", which
150 # is close to ISO8601, but lacks of T as spacer: "yyyy-MM-ddTHH:mm:ss"
152 if [notificationTime] {
155 "notificationTime", " ", "T"
159 match => [ "notificationTime", ISO8601 ]
160 target => "notificationTime"
166 # Renaming some fields for readability
168 if [AAI][generic-vnf.vnf-name] {
170 add_field => { "vnfName" => "%{[AAI][generic-vnf.vnf-name]}" }
173 if [AAI][generic-vnf.vnf-type] {
175 add_field => { "vnfType" => "%{[AAI][generic-vnf.vnf-type]}" }
178 if [AAI][vserver.vserver-name] {
180 add_field => { "vmName" => "%{[AAI][vserver.vserver-name]}" }
183 if [AAI][complex.city] {
185 add_field => { "locationCity" => "%{[AAI][complex.city]}" }
188 if [AAI][complex.state] {
190 add_field => { "locationState" => "%{[AAI][complex.state]}" }
196 # Adding some flags to ease aggregation
198 if [closedLoopEventStatus] =~ /(?i)ABATED/ {
200 add_field => { "flagAbated" => "1" }
203 if [notification] =~ /^.*?(?:\b|_)FINAL(?:\b|_).*?(?:\b|_)FAILURE(?:\b|_).*?$/ {
205 add_field => { "flagFinalFailure" => "1" }
210 if "error" not in [@metadata][request][tags]{
212 # Creating data for a secondary index
215 clones => [ "event-cl-aggs" ]
216 add_tag => [ "event-cl-aggs" ]
219 if "event-cl-aggs" in [@metadata][request][tags]{
221 # we only need a few fields for aggregations; remove all fields from clone except :
222 # vmName,vnfName,vnfType,requestID,closedLoopAlarmStart, closedLoopControlName,closedLoopAlarmEnd,abated,nbrDmaapevents,finalFailure
225 whitelist_names => ["^@.*$","^topic$","^type$","^tags$","^flagFinalFailure$","^flagAbated$","^locationState$","^locationCity$","^vmName$","^vnfName$","^vnfType$","^requestID$","^closedLoopAlarmStart$","^closedLoopControlName$","^closedLoopAlarmEnd$","^target$","^target_type$","^triggerSourceName$","^policyScope$","^policyName$","^policyVersion$"]
238 if "error" in [tags] {
241 hosts => ["${elasticsearch_base_url}"]
242 index => "errors-%{+YYYY.MM.DD}"
243 doc_as_upsert => true
246 } else if "event-cl-aggs" in [tags] {
249 hosts => ["${elasticsearch_base_url}"]
250 document_id => "%{requestID}"
251 index => "events-cl-%{+YYYY.MM.DD}" # creates daily indexes for control loop
252 doc_as_upsert => true
259 hosts => ["${elasticsearch_base_url}"]
260 index => "events-%{+YYYY.MM.DD}" # creates daily indexes
261 doc_as_upsert => true