Alerts changes

NOTE: database schema changed. Existing alerts will be lost.

- Unified engaged and closed tables
- Simplified hosts engaged alert counters handling: periodically set by lua
- Removed alert engine and replaced with alert periodicity
- Now engage is implicitly derived from the alert end timestamp and periodicity
- New alerts_api.lua to easily emit alerts
- Removed past alerts counter aggregation by hash
- Alert notifications for non-flow alerts are now removed from C and triggered by lua
This commit is contained in:
emanuele-f 2019-06-28 10:43:13 +02:00
parent ae4770fe7d
commit a9d3c78587
30 changed files with 1055 additions and 1332 deletions

View file

@ -11,6 +11,7 @@ require "flow_utils"
local format_utils = require "format_utils"
local json = require "dkjson"
local alerts_api = require "alerts_api"
sendHTTPHeader('application/json')
@ -61,6 +62,17 @@ local function formatAlertRecord(alert_entity, record)
column_msg = formatRawFlow(record, record["alert_json"])
elseif alert_entity == "User" then
column_msg = formatRawUserActivity(record, record["alert_json"])
else
local alert_obj = alerts_api.parseAlert(record)
if(alert_obj.formatter ~= nil) then
local msg = record["alert_json"]
if(string.sub(msg, 1, 1) == "{") then
msg = json.decode(msg)
end
column_msg = alert_obj.formatter(msg, record)
end
end
column_msg = string.gsub(column_msg, '"', "'")