Graylog2 / Graylog2/graylog2-server
Pipeline facade should parse rules for entity links
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Some rule functions refer to existing entities, but the facade does not know about these links without inspecting the actual rule.
## Expected Behavior
If you add a rule to a content pack that uses a lookup table the content pack engine should be able to detect that relationship.
## Current Behavior
The pipeline facade is lacking the necessary metadata from functions to detect relationships. Pipeline rule functions also have no support to expose this kind of information.
The resulting content pack is not complete and will not work properly if the user is not aware that they have to also include the lookup table.
## Possible Solution
`PipelineFacade` should parse the rules and use a custom AST visitor to look for relationships.
This would require an extension of the function type, which would allow functions to return relationships to other entities, as long as those are statically known.
In the example below the `lookup_value` function is able to determine the lookup table that it is using, so the content pack engine can actually resolve the relationship.
The same applies to the `route_to_stream` and possibly `from_input` functions.
The same functionality could be used to create a usage graph internally, so it's useful beyond this issue.
## Steps to Reproduce (for bugs)
1. Create a pipeline rule with source code:
```
rule "test"
when true
then
lookup_value("some_table", "test");
end
```
2. Create a content pack with that rule.
3. Note that the content pack engine does not list `some_table` in the entity list, whether it exists in the system or not.
## Your Environment
* Graylog Version: 3.0
Contributor guide
Assessment
This issue has not been assessed yet.