import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitIdentifier(RuleLangParser.IdentifierContext ctx) {
    // unquote identifier if necessary
    final String identifierName = unquote(ctx.Identifier().getText(), '`');

    if (!isIdIsFieldAccess.peek() && !definedVars.contains(identifierName)) {
        parseContext.addError(new UndeclaredVariable(ctx));
    }
    final Expression expr;
    String type;
    // if the identifier is also a declared variable name prefer the variable
    if (isIdIsFieldAccess.peek() && !definedVars.contains(identifierName)) {
        expr = new FieldRefExpression(ctx.getStart(), identifierName, parseContext.getDefinedVar(identifierName));
        type = "FIELDREF";
    } else {
        expr = new VarRefExpression(ctx.getStart(), identifierName, parseContext.getDefinedVar(identifierName));
        type = "VARREF";
    }
    log.trace("{}: ctx {} => {}", type, ctx, expr);
    exprs.put(ctx, expr);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
private void triggerAbstractEnter(RuleAstListener listener, Expression expr) {
    
    if (expr instanceof BinaryExpression) {
        listener.enterBinary((BinaryExpression) expr);
        
    } else if (expr instanceof UnaryExpression) { // must not be first in "else if" because "binary is instanceof unary" 
        listener.enterUnary((UnaryExpression) expr);
    }
    // for the others we trigger regardless whether it's a binary or unary expr
    if (expr instanceof LogicalExpression) {
        listener.enterLogical((LogicalExpression) expr);
    }
    if (expr instanceof NumericExpression) {
        listener.enterNumeric((NumericExpression) expr);
    }
    if (expr instanceof ConstantExpression) {
        listener.enterConstant((ConstantExpression) expr);
    }
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
private void triggerAbstractExit(RuleAstListener listener, Expression expr) {
    if (expr instanceof BinaryExpression) {
        listener.exitBinary((BinaryExpression) expr);

    } else if (expr instanceof UnaryExpression) { // must not be first in "else if" because "binary is instanceof unary" 
        listener.exitUnary((UnaryExpression) expr);
    }
    // for the others we trigger regardless whether it's a binary or unary expr
    if (expr instanceof LogicalExpression) {
        listener.exitLogical((LogicalExpression) expr);
    }
    if (expr instanceof NumericExpression) {
        listener.exitNumeric((NumericExpression) expr);
    }
    if (expr instanceof ConstantExpression) {
        listener.exitConstant((ConstantExpression) expr);
    }
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
default void preprocessArgs(FunctionArgs args) {
    for (Map.Entry<String, Expression> e : args.getConstantArgs().entrySet()) {
        final String name = e.getKey();
        try {
            final Object value = preComputeConstantArgument(args, name, e.getValue());
            if (value != null) {
                //noinspection unchecked
                final ParameterDescriptor<Object, Object> param = (ParameterDescriptor<Object, Object>) args.param(name);
                if (param == null) {
                    throw new IllegalStateException("Unknown parameter " + name + "! Cannot continue.");
                }
                args.setPreComputedValue(name, param.transform().apply(value));
            }
        } catch (Exception exception) {
            log.debug("Unable to precompute argument value for " + name, exception);
            throw new PrecomputeFailure(name, exception);
        }
    }

}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Test
public void evaluate_returns_result_for_valid_CEF_string() throws Exception {
    final Map<String, Expression> arguments = ImmutableMap.of(
            CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|vendor|product|1.0|id|name|low|dvc=example.com msg=Foobar"),
            CEFParserFunction.USE_FULL_NAMES, new BooleanExpression(new CommonToken(0), false)
    );
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);

    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNotNull(result);
    assertEquals(0, result.get("cef_version"));
    assertEquals("vendor", result.get("device_vendor"));
    assertEquals("product", result.get("device_product"));
    assertEquals("1.0", result.get("device_version"));
    assertEquals("id", result.get("device_event_class_id"));
    assertEquals("low", result.get("severity"));
    assertEquals("example.com", result.get("dvc"));
    assertEquals("Foobar", result.get("msg"));
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Test
public void evaluate_returns_result_for_valid_CEF_string_with_short_names_if_useFullNames_parameter_is_missing() throws Exception {
    final Map<String, Expression> arguments = Collections.singletonMap(
            CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|vendor|product|1.0|id|name|low|dvc=example.com msg=Foobar")
    );
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);

    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNotNull(result);
    assertEquals(0, result.get("cef_version"));
    assertEquals("vendor", result.get("device_vendor"));
    assertEquals("product", result.get("device_product"));
    assertEquals("1.0", result.get("device_version"));
    assertEquals("id", result.get("device_event_class_id"));
    assertEquals("low", result.get("severity"));
    assertEquals("example.com", result.get("dvc"));
    assertEquals("Foobar", result.get("msg"));
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Test
public void evaluate_returns_result_for_valid_CEF_string_with_full_names() throws Exception {
    final CEFParserFunction function = new CEFParserFunction(new MetricRegistry());
    final Map<String, Expression> arguments = ImmutableMap.of(
            CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|vendor|product|1.0|id|name|low|dvc=example.com msg=Foobar"),
            CEFParserFunction.USE_FULL_NAMES, new BooleanExpression(new CommonToken(0), true)
    );
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);

    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNotNull(result);
    assertEquals(0, result.get("cef_version"));
    assertEquals("vendor", result.get("device_vendor"));
    assertEquals("product", result.get("device_product"));
    assertEquals("1.0", result.get("device_version"));
    assertEquals("id", result.get("device_event_class_id"));
    assertEquals("low", result.get("severity"));
    assertEquals("example.com", result.get("deviceAddress"));
    assertEquals("Foobar", result.get("message"));
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Test
public void evaluate_returns_result_without_message_field() throws Exception {
    final Map<String, Expression> arguments = ImmutableMap.of(
            CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|vendor|product|1.0|id|name|low|dvc=example.com"),
            CEFParserFunction.USE_FULL_NAMES, new BooleanExpression(new CommonToken(0), false)
    );
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);

    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNotNull(result);
    assertEquals(0, result.get("cef_version"));
    assertEquals("vendor", result.get("device_vendor"));
    assertEquals("product", result.get("device_product"));
    assertEquals("1.0", result.get("device_version"));
    assertEquals("id", result.get("device_event_class_id"));
    assertEquals("low", result.get("severity"));
    assertEquals("example.com", result.get("dvc"));
    assertFalse(result.containsKey("message"));
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitVarAssignStmt(RuleLangParser.VarAssignStmtContext ctx) {
    final String name = unquote(ctx.varName.getText(), '`');
    final Expression expr = exprs.get(ctx.expression());
    parseContext.defineVar(name, expr);
    definedVars.add(name);
    parseContext.statements.add(new VarAssignStatement(name, expr));
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitNamedArgs(RuleLangParser.NamedArgsContext ctx) {
    final Map<String, Expression> argMap = Maps.newHashMap();
    for (RuleLangParser.PropAssignmentContext propAssignmentContext : ctx.propAssignment()) {
        final String argName = unquote(propAssignmentContext.Identifier().getText(), '`');
        final Expression argValue = exprs.get(propAssignmentContext.expression());
        argMap.put(argName, argValue);
    }
    args.put(ctx, argMap);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitNested(RuleLangParser.NestedContext ctx) {
    isIdIsFieldAccess.pop(); // reset for error checks
    final Expression object = exprs.get(ctx.fieldSet);
    final Expression field = exprs.get(ctx.field);
    final FieldAccessExpression expr = new FieldAccessExpression(ctx.getStart(), object, field);
    log.trace("FIELDACCESS: ctx {} => {}", ctx, expr);
    exprs.put(ctx, expr);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitNot(RuleLangParser.NotContext ctx) {
    final Expression expression = upgradeBoolFunctionExpression(ctx.expression());
    final NotExpression expr = new NotExpression(ctx.getStart(), expression);
    log.trace("NOT: ctx {} => {}", ctx, expr);
    exprs.put(ctx, expr);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitAnd(RuleLangParser.AndContext ctx) {
    // if the expressions are function calls but boolean valued, upgrade them,
    // we allow testing boolean valued functions without explicit comparison operator
    final Expression left = upgradeBoolFunctionExpression(ctx.left);
    final Expression right = upgradeBoolFunctionExpression(ctx.right);

    final AndExpression expr = new AndExpression(ctx.getStart(), left, right);
    log.trace("AND: ctx {} => {}", ctx, expr);
    exprs.put(ctx, expr);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
private Expression upgradeBoolFunctionExpression(RuleLangParser.ExpressionContext leftExprContext) {
    Expression leftExpr = exprs.get(leftExprContext);
    if (leftExpr instanceof FunctionExpression && leftExpr.getType().equals(Boolean.class)) {
        leftExpr = new BooleanValuedFunctionWrapper(leftExprContext.getStart(), leftExpr);
    }
    return leftExpr;
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitOr(RuleLangParser.OrContext ctx) {
    final Expression left = upgradeBoolFunctionExpression(ctx.left);
    final Expression right = upgradeBoolFunctionExpression(ctx.right);
    final OrExpression expr = new OrExpression(ctx.getStart(), left, right);
    log.trace("OR: ctx {} => {}", ctx, expr);
    exprs.put(ctx, expr);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitEquality(RuleLangParser.EqualityContext ctx) {
    final Expression left = exprs.get(ctx.left);
    final Expression right = exprs.get(ctx.right);
    final boolean equals = ctx.equality.getText().equals("==");
    final EqualityExpression expr = new EqualityExpression(ctx.getStart(), left, right, equals);
    log.trace("EQUAL: ctx {} => {}", ctx, expr);
    exprs.put(ctx, expr);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitComparison(RuleLangParser.ComparisonContext ctx) {
    final Expression left = exprs.get(ctx.left);
    final Expression right = exprs.get(ctx.right);
    final String operator = ctx.comparison.getText();
    final ComparisonExpression expr = new ComparisonExpression(ctx.getStart(), left, right, operator);
    log.trace("COMPARE: ctx {} => {}", ctx, expr);
    exprs.put(ctx, expr);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitMapLiteralExpr(RuleLangParser.MapLiteralExprContext ctx) {
    final HashMap<String, Expression> map = Maps.newHashMap();
    for (RuleLangParser.PropAssignmentContext propAssignmentContext : ctx.propAssignment()) {
        final String key = unquote(propAssignmentContext.Identifier().getText(), '`');
        final Expression value = exprs.get(propAssignmentContext.expression());
        map.put(key, value);
    }
    exprs.put(ctx, new MapLiteralExpression(ctx.getStart(), map));
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitAddition(RuleLangParser.AdditionContext ctx) {
    final Expression left = exprs.get(ctx.left);
    final Expression right = exprs.get(ctx.right);
    final boolean isPlus = ctx.add.getText().equals("+");

    final AdditionExpression expr = new AdditionExpression(ctx.getStart(), left, right, isPlus);
    log.trace("ADD: ctx {} => {}", ctx, expr);
    exprs.put(ctx, expr);
}
 

import org.graylog.plugins.pipelineprocessor.ast.expressions.Expression; //导入依赖的package包/类
@Override
public void exitMultiplication(RuleLangParser.MultiplicationContext ctx) {
    final Expression left = exprs.get(ctx.left);
    final Expression right = exprs.get(ctx.right);
    final char operator = ctx.mult.getText().charAt(0);

    final MultiplicationExpression expr = new MultiplicationExpression(ctx.getStart(), left, right, operator);
    log.trace("MULT: ctx {} => {}", ctx, expr);
    exprs.put(ctx, expr);
}