gfwleak/galaxy-deployment-updata-record
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CN 24.08.1 change groot config base 1.3.2

Browse Source
This commit is contained in:
gujinkai
2024-11-08 16:26:07 +08:00
parent 0b702062e4
commit 3da93049e1
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cyber_narrator/upgrade/2024/CN-24.08/groot-stream/1.3.2/24.08.1/etl_session_record_kafka_to_cn_kafka
View File

@@ -186,12 +186,12 @@ processing_pipelines:
- function: EVAL - function: EVAL
output_fields: [ client_zone ] output_fields: [ client_zone ]
parameters: parameters:
value_expression: "(flags & 8) == 8 ? 'internal' : 'external'" value_expression: "flags & 8 == 8 ? 'internal' : 'external'"
- function: EVAL - function: EVAL
output_fields: [ server_zone ] output_fields: [ server_zone ]
parameters: parameters:
value_expression: "(flags & 16) == 16 ? 'internal' : 'external'" value_expression: "flags & 16 == 16 ? 'internal' : 'external'"
- function: CN_IP_ZONE_LOOKUP - function: CN_IP_ZONE_LOOKUP
lookup_fields: [ client_ip ] lookup_fields: [ client_ip ]
@@ -210,22 +210,22 @@ processing_pipelines:
- function: EVAL - function: EVAL
output_fields: [ sent_bytes ] output_fields: [ sent_bytes ]
parameters: parameters:
value_expression: "is_def(sent_bytes) ? sent_bytes : 0" value_expression: "sent_bytes == null ? 0 : sent_bytes"
- function: EVAL - function: EVAL
output_fields: [ sent_pkts ] output_fields: [ sent_pkts ]
parameters: parameters:
value_expression: "is_def(sent_pkts) ? sent_pkts : 0" value_expression: "sent_pkts == null ? 0 : sent_pkts"
- function: EVAL - function: EVAL
output_fields: [ received_bytes ] output_fields: [ received_bytes ]
parameters: parameters:
value_expression: "is_def(received_bytes) ? received_bytes : 0" value_expression: "received_bytes == null ? 0 : received_bytes"
- function: EVAL - function: EVAL
output_fields: [ received_pkts ] output_fields: [ received_pkts ]
parameters: parameters:
value_expression: "is_def(received_pkts) ? received_pkts : 0" value_expression: "received_pkts == null ? 0 : received_pkts"
- function: EVAL - function: EVAL
output_fields: [ traffic_inbound_byte ] output_fields: [ traffic_inbound_byte ]

4
cyber_narrator/upgrade/2024/CN-24.08/groot-stream/1.3.2/README.md Normal file
View File

@@ -0,0 +1,4 @@
1.3.2 -> 1.7.0
1. Eval函数调整为AviatorScript，脚本编写细节有变化
2. Rename函数有变更
3. pipeline projection type 变更