Graylog2 / Graylog2/graylog2-server

Pipeline facade should parse rules for entity links

Open
#5,440 0 comments 0 reactions 0 assignees View on GitHub
#M bug content-packs improvement
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Some rule functions refer to existing entities, but the facade does not know about these links without inspecting the actual rule.

## Expected Behavior
If you add a rule to a content pack that uses a lookup table the content pack engine should be able to detect that relationship.

## Current Behavior
The pipeline facade is lacking the necessary metadata from functions to detect relationships. Pipeline rule functions also have no support to expose this kind of information.
The resulting content pack is not complete and will not work properly if the user is not aware that they have to also include the lookup table.

## Possible Solution
`PipelineFacade` should parse the rules and use a custom AST visitor to look for relationships.
This would require an extension of the function type, which would allow functions to return relationships to other entities, as long as those are statically known.
In the example below the `lookup_value` function is able to determine the lookup table that it is using, so the content pack engine can actually resolve the relationship.
The same applies to the `route_to_stream` and possibly `from_input` functions.

The same functionality could be used to create a usage graph internally, so it's useful beyond this issue.

## Steps to Reproduce (for bugs)
1. Create a pipeline rule with source code:
```
rule "test"
when true
then
lookup_value("some_table", "test");
end
```
2. Create a content pack with that rule.
3. Note that the content pack engine does not list `some_table` in the entity list, whether it exists in the system or not.

## Your Environment

* Graylog Version: 3.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.