gfwleak/galaxy-tsg-olap-dos-detection-job
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TSG-21936 适配metrics格式修改为扁平化

Browse Source
This commit is contained in:
wangkuan
2024-07-26 18:30:17 +08:00
parent 2d4f255a8d
commit 2d0dcf89e3
2 changed files with 9 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pom.xml
View File

@@ -6,7 +6,7 @@
<groupId>com.zdjizhi</groupId> <groupId>com.zdjizhi</groupId>
<artifactId>flink-dos-detection</artifactId> <artifactId>flink-dos-detection</artifactId>
<version>24-04-19</version> <version>24-07-25</version>
<name>flink-dos-detection</name> <name>flink-dos-detection</name>
<url>http://www.example.com</url> <url>http://www.example.com</url>
@@ -80,7 +80,7 @@
</goals> </goals>
<configuration> <configuration>
<finalName>flink-dos-detection-24-04-19</finalName> <finalName>flink-dos-detection-24-07-25</finalName>
<relocations> <relocations>
<relocation> <relocation>
<pattern>org.apache.http</pattern> <pattern>org.apache.http</pattern>

37
src/main/java/com/zdjizhi/function/FlatSketchFunction.java
View File

@@ -21,52 +21,29 @@ public class FlatSketchFunction implements FlatMapFunction<String, DosSketchLog>
try { try {
if (StringUtil.isNotBlank(value)) { if (StringUtil.isNotBlank(value)) {
DosSketchLog dosSketchLog = new DosSketchLog(); DosSketchLog dosSketchLog = JSONObject.parseObject(value, DosSketchLog.class);
dosSketchLog.setRecv_time(System.currentTimeMillis()/1000); dosSketchLog.setRecv_time(System.currentTimeMillis()/1000);
DosSketchMetricsLog dosSketchMetricsLog = JSONObject.parseObject(value, DosSketchMetricsLog.class); dosSketchLog.setStart_timestamp_ms(dosSketchLog.getTimestamp_ms());
dosSketchLog.setVsys_id(Integer.parseInt(dosSketchMetricsLog.getTags().getOrDefault("vsys_id", "1"))); dosSketchLog.setEnd_timestamp_ms(dosSketchLog.getTimestamp_ms() + dosSketchLog.getDuration());
dosSketchLog.setServer_ip(dosSketchMetricsLog.getTags().getOrDefault("server_ip", "").trim());
dosSketchLog.setDecoded_as(dosSketchMetricsLog.getTags().getOrDefault("decoded_as", "").trim());
dosSketchLog.setDuration(Long.parseLong(dosSketchMetricsLog.getTags().getOrDefault("duration","60000")));
dosSketchLog.setTimestamp_ms(dosSketchMetricsLog.getTimestamp_ms());
dosSketchLog.setStart_timestamp_ms(dosSketchMetricsLog.getTimestamp_ms());
dosSketchLog.setEnd_timestamp_ms(dosSketchMetricsLog.getTimestamp_ms() + dosSketchLog.getDuration());
dosSketchLog.setClient_ip(dosSketchMetricsLog.getTags().getOrDefault("client_ip", "").trim());
dosSketchLog.setData_center(dosSketchMetricsLog.getTags().getOrDefault("data_center", "").trim());
dosSketchLog.setDevice_id(dosSketchMetricsLog.getTags().getOrDefault("device_id", "").trim());
dosSketchLog.setDevice_group(dosSketchMetricsLog.getTags().getOrDefault("device_group", "").trim());
dosSketchLog.setServer_country(dosSketchMetricsLog.getTags().getOrDefault("server_country", "").trim());
dosSketchLog.setClient_country(dosSketchMetricsLog.getTags().getOrDefault("client_country", "").trim());
dosSketchLog.setRule_id(Integer.parseInt(dosSketchMetricsLog.getTags().getOrDefault("rule_id", "0")));
dosSketchLog.setName(dosSketchMetricsLog.getTags().getOrDefault("name", ""));
HashSet<String> client_ips = new HashSet<>(); HashSet<String> client_ips = new HashSet<>();
HashSet<String> client_countrys = new HashSet<>(); HashSet<String> client_countrys = new HashSet<>();
dosSketchLog.setClient_ips(client_ips); dosSketchLog.setClient_ips(client_ips);
dosSketchLog.setClient_countrys(client_countrys); dosSketchLog.setClient_countrys(client_countrys);
if("top_client_and_server_ip".equals(dosSketchMetricsLog.getName())){ if("top_client_and_server_ip".equals(dosSketchLog.getName())){
dosSketchLog.setPkts(dosSketchMetricsLog.getFields().getOrDefault("pkts",0L));
dosSketchLog.setBytes(dosSketchMetricsLog.getFields().getOrDefault("bytes",0L));
dosSketchLog.setSessions(dosSketchMetricsLog.getFields().getOrDefault("sessions",0L));
client_ips.add(dosSketchLog.getClient_ip()); client_ips.add(dosSketchLog.getClient_ip());
if(!dosSketchLog.getClient_country().isEmpty()) { if(dosSketchLog.getClient_country()!=null && !dosSketchLog.getClient_country().isEmpty()) {
client_countrys.add(dosSketchLog.getClient_country()); client_countrys.add(dosSketchLog.getClient_country());
} }
} }
else if("top_client_ip_and_server_ip".equals(dosSketchMetricsLog.getName())){ else if("top_client_ip_and_server_ip".equals(dosSketchLog.getName())){
dosSketchLog.setPkts(0); dosSketchLog.setPkts(0);
dosSketchLog.setBytes(0); dosSketchLog.setBytes(0);
dosSketchLog.setSessions(0); dosSketchLog.setSessions(0);
client_ips.add(dosSketchLog.getClient_ip()); client_ips.add(dosSketchLog.getClient_ip());
if(!dosSketchLog.getClient_country().isEmpty()) { if(dosSketchLog.getClient_country()!=null && !dosSketchLog.getClient_country().isEmpty()) {
client_countrys.add(dosSketchLog.getClient_country()); client_countrys.add(dosSketchLog.getClient_country());
} }
} }
else {
dosSketchLog.setPkts(dosSketchMetricsLog.getFields().getOrDefault("pkts",0L));
dosSketchLog.setBytes(dosSketchMetricsLog.getFields().getOrDefault("bytes",0L));
dosSketchLog.setSessions(dosSketchMetricsLog.getFields().getOrDefault("sessions",0L));
}
out.collect(dosSketchLog); out.collect(dosSketchLog);
} }
} catch (Exception e) { } catch (Exception e) {