Class: AWSCDK::Logs::CfnTransformer::ParseToOCSFProperty

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
logs/cfn_transformer.rb

Overview

This processor converts logs into Open Cybersecurity Schema Framework (OCSF) events.

For more information about this processor including examples, see parseToOCSF in the CloudWatch Logs User Guide .

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(event_source:, ocsf_version:, mapping_version: nil, source: nil) ⇒ ParseToOCSFProperty

Returns a new instance of ParseToOCSFProperty.

Parameters:

  • event_source (String) —

    Specify the service or process that produces the log events that will be converted with this processor.

  • ocsf_version (String) —

    Specify which version of the OCSF schema to use for the transformed log events.

  • mapping_version (String, nil) (defaults to: nil) —

    The version of the OCSF mapping to use for parsing log data.

  • source (String, nil) (defaults to: nil) —

    The path to the field in the log event that you want to parse.



1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
 
# File 'logs/cfn_transformer.rb', line 1461

def initialize(event_source:, ocsf_version:, mapping_version: nil, source: nil)
  @event_source = event_source
  Jsii::Type.check_type(@event_source, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "eventSource")
  @ocsf_version = ocsf_version
  Jsii::Type.check_type(@ocsf_version, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "ocsfVersion")
  @mapping_version = mapping_version
  Jsii::Type.check_type(@mapping_version, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "mappingVersion") unless @mapping_version.nil?
  @source = source
  Jsii::Type.check_type(@source, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "source") unless @source.nil?
end

Instance Attribute Details

#event_source ⇒ String (readonly)

Specify the service or process that produces the log events that will be converted with this processor.

Returns:

  • (String)

See Also:



1476
1477
1478
 
# File 'logs/cfn_transformer.rb', line 1476

def event_source
  @event_source
end

#mapping_version ⇒ String? (readonly)

The version of the OCSF mapping to use for parsing log data.

Returns:

  • (String, nil)

See Also:



1486
1487
1488
 
# File 'logs/cfn_transformer.rb', line 1486

def mapping_version
  @mapping_version
end

#ocsf_version ⇒ String (readonly)

Specify which version of the OCSF schema to use for the transformed log events.

Returns:

  • (String)

See Also:



1481
1482
1483
 
# File 'logs/cfn_transformer.rb', line 1481

def ocsf_version
  @ocsf_version
end

#source ⇒ String? (readonly)

The path to the field in the log event that you want to parse.

If you omit this value, the whole log message is parsed.

Returns:

  • (String, nil)

See Also:



1493
1494
1495
 
# File 'logs/cfn_transformer.rb', line 1493

def source
  @source
end

Class Method Details

.jsii_properties ⇒ Object 



1495
1496
1497
1498
1499
1500
1501
1502
 
# File 'logs/cfn_transformer.rb', line 1495

def self.jsii_properties
  {
    :event_source => "eventSource",
    :ocsf_version => "ocsfVersion",
    :mapping_version => "mappingVersion",
    :source => "source",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
 
# File 'logs/cfn_transformer.rb', line 1504

def to_jsii
  result = {}
  result.merge!({
    "eventSource" => @event_source,
    "ocsfVersion" => @ocsf_version,
    "mappingVersion" => @mapping_version,
    "source" => @source,
  })
  result.compact
end