ParserCfg (secops-beam 0.19.2 API)

java.lang.Object
- com.mozilla.secops.parser.ParserCfg

All Implemented Interfaces:

Serializable
```
public class ParserCfg
extends Object
implements Serializable
```
Represents configuration data used to configure an instance of a Parser

See Also:

Serialized Form

Constructor Summary

Constructors
Constructor and Description

ParserCfg()
Construct default parser configuration

Constructors
Constructor and Description
`ParserCfg()` Construct default parser configuration

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`static ParserCfg`	`fromInputOptions(InputOptions options)` Create a parser configuration from pipeline `InputOptions`
`Boolean`	`getDeferGeoIpResolution()` Get defer GeoIP resolution setting
`Boolean`	`getDisableCloudwatchStrip()` Get disable Cloudwatch strip flag
`Boolean`	`getDisableMozlogStrip()` Get disable Mozlog strip flag
`String`	`getIdentityManagerPath()` Get IdentityManager json file path
`String`	`getMaxmindCityDbPath()` Get Maxmind City database path
`String`	`getMaxmindIspDbPath()` Get Maxmind ISP database path
`Integer`	`getMaxTimestampDifference()` Get maximum allowable timestamp difference
`String`	`getParserFastMatcher()`
`String[]`	`getStackdriverLabelFilters()` Get Stackdriver label filters
`String`	`getStackdriverProjectFilter()` Get Stackdriver project filter
`Boolean`	`getUseEventTimestamp()` Get event timestamp emission setting
`Boolean`	`getUseProxyXff()` Get whether to use the proxy header to select ip from XFF
`Boolean`	`getUseXffAsRemote()` Get Use Xff Header as Remote
`ArrayList<String>`	`getXffAddressSelector()` Get any configured XFF address selectors
`CidrUtil`	`getXffAddressSelectorAsCidrUtil()` Return any configured XFF address selectors as a `CidrUtil` object.
`void`	`setDeferGeoIpResolution(Boolean deferGeoIpResolution)` Set defer GeoIP resolution
`void`	`setDisableCloudwatchStrip(boolean disableCloudwatchStrip)` Set disable Cloudwatch strip
`void`	`setDisableMozlogStrip(boolean disableMozlogStrip)` Set disable Mozlog strip
`void`	`setIdentityManagerPath(String path)` Set IdentityManager json file path
`void`	`setMaxmindCityDbPath(String path)` Set Maxmind City database path
`void`	`setMaxmindIspDbPath(String path)` Set Maxmind ISP database path
`void`	`setMaxTimestampDifference(Integer maxTimestampDifference)` Set maximum allowable timestamp difference
`void`	`setParserFastMatcher(String fastMatcher)` Set parser fast matcher
`void`	`setStackdriverLabelFilters(String[] stackdriverLabelFilters)` Set Stackdriver label filters
`void`	`setStackdriverProjectFilter(String stackdriverProjectFilter)` Set Stackdriver project filter
`void`	`setUseEventTimestamp(Boolean useEventTimestamp)` Set event timestamp emission setting
`void`	`setUseProxyXff(Boolean useProxyXff)` Set enable proxy xff
`void`	`setUseXffAsRemote(Boolean xffAsRemote)` Parse the X-Forwarded-For header instead of the remote addr
`void`	`setXffAddressSelector(ArrayList<String> subnets)` Set XFF address selectors

Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - ParserCfg
```
public ParserCfg()
```
    Construct default parser configuration
- Method Detail
  - fromInputOptions
```
public static ParserCfg fromInputOptions(InputOptions options)
```
    Create a parser configuration from pipeline InputOptions
    
    Parameters:
    
    options - Input options
    
    Returns:
    
    Parser configuration
  - setXffAddressSelector
```
public void setXffAddressSelector(ArrayList<String> subnets)
```
    Set XFF address selectors
    The subnets parameter should be an ArrayList containing CIDR subnets that will be used as hints for selecting a real client IP address in the event parsers see an X-Forwarded-For style address list.
    If any address in the log entry address list matches a subnet in the configured selector list, the address directly to the left will be used as the real client IP address.
    If this value is not set, the rightmost address will always be used as the actual client IP address.
    This option is intended to behave in a similar manner to the nginx realip module, https://nginx.org/en/docs/http/ngx_http_realip_module.html.
    
    Parameters:
    
    subnets - Arraylist containing subnets
  - getXffAddressSelector
```
public ArrayList<String> getXffAddressSelector()
```
    Get any configured XFF address selectors
    
    Returns:
    
    ArrayList of subnets, or null if unset
  - getXffAddressSelectorAsCidrUtil
```
public CidrUtil getXffAddressSelectorAsCidrUtil()
```
    Return any configured XFF address selectors as a CidrUtil object.
    
    Returns:
    
    CidrUtil or null if not set
  - getMaxmindCityDbPath
```
public String getMaxmindCityDbPath()
```
    Get Maxmind City database path
    
    Returns:
    
    String or null if not specified
  - setMaxmindCityDbPath
```
public void setMaxmindCityDbPath(String path)
```
    Set Maxmind City database path
    
    Parameters:
    
    path - Path
  - getMaxmindIspDbPath
```
public String getMaxmindIspDbPath()
```
    Get Maxmind ISP database path
    
    Returns:
    
    String or null if not specified
  - setMaxmindIspDbPath
```
public void setMaxmindIspDbPath(String path)
```
    Set Maxmind ISP database path
    
    Parameters:
    
    path - Path
  - getIdentityManagerPath
```
public String getIdentityManagerPath()
```
    Get IdentityManager json file path
    
    Returns:
    
    String of null if not specified
  - setIdentityManagerPath
```
public void setIdentityManagerPath(String path)
```
    Set IdentityManager json file path
    
    Parameters:
    
    path - Path
  - getParserFastMatcher
```
public String getParserFastMatcher()
```
  - setParserFastMatcher
```
public void setParserFastMatcher(String fastMatcher)
```
    Set parser fast matcher
    If a fast matcher is set in the parser, an input string is immediately tested to see if it contains the supplied substring. If not, the event is dropped prior to performing the bulk of the parsing/filtering operations.
    Note that this is intended to reduce pressure on the parser and should not be treated as a filter, as there are certain cases (such as with configuration tick events) that messages that do not match the fast matcher will still be returned.
    
    Parameters:
    
    fastMatcher - Matcher substring
  - getUseEventTimestamp
```
public Boolean getUseEventTimestamp()
```
    Get event timestamp emission setting
    
    Returns:
    
    Boolean
  - setUseEventTimestamp
```
public void setUseEventTimestamp(Boolean useEventTimestamp)
```
    Set event timestamp emission setting
    This option is only applicable when the parser is being used within ParserDoFn.
    If true, events will be output in the pipeline using the timestamp within the event rather than the default timestamp that would be assigned.
    
    Parameters:
    
    useEventTimestamp - Boolean
  - getStackdriverLabelFilters
```
public String[] getStackdriverLabelFilters()
```
    Get Stackdriver label filters
    
    Returns:
    
    Array of key:value labels that must match
  - setStackdriverLabelFilters
```
public void setStackdriverLabelFilters(String[] stackdriverLabelFilters)
```
    Set Stackdriver label filters
    This option is only applicable when the parser is being used within ParserDoFn.
    If set, events that do not match the label specification will be dropped.
    
    Parameters:
    
    stackdriverLabelFilters - Array of key:value labels that must match
  - getStackdriverProjectFilter
```
public String getStackdriverProjectFilter()
```
    Get Stackdriver project filter
    
    Returns:
    
    Project filter value
  - setStackdriverProjectFilter
```
public void setStackdriverProjectFilter(String stackdriverProjectFilter)
```
    Set Stackdriver project filter
    This option is only applicable when the parser is being used within ParserDoFn
    If set, events that do not have the specified Stackdriver project value will be dropped.
    
    Parameters:
    
    stackdriverProjectFilter - Project value
  - setDisableCloudwatchStrip
```
public void setDisableCloudwatchStrip(boolean disableCloudwatchStrip)
```
    Set disable Cloudwatch strip
    If it is known ahead of time the parser will never have to strip cloudwatch encapsulation off an event, this flag can be enabled which will increase parser performance.
    
    Parameters:
    
    disableCloudwatchStrip - Boolean
  - getDisableCloudwatchStrip
```
public Boolean getDisableCloudwatchStrip()
```
    Get disable Cloudwatch strip flag
    
    Returns:
    
    Boolean
  - setDisableMozlogStrip
```
public void setDisableMozlogStrip(boolean disableMozlogStrip)
```
    Set disable Mozlog strip
    If it is known ahead of time the parser will never have to strip mozlog encapsulation off an event, this flag can be enabled which will increase parser performance.
    
    Parameters:
    
    disableMozlogStrip - Boolean
  - getDisableMozlogStrip
```
public Boolean getDisableMozlogStrip()
```
    Get disable Mozlog strip flag
    
    Returns:
    
    Boolean
  - setMaxTimestampDifference
```
public void setMaxTimestampDifference(Integer maxTimestampDifference)
```
    Set maximum allowable timestamp difference
    If set, events which are parsed will have the timestamp included with the event compared against the current time. If the difference exceeds the specified value in seconds, the event will be dropped.
    By default, this value is not set. Note that not all payload parsers will extract and set an event timestamp. In cases where this does not happen, the event timestamp will just default to the time the event was parsed (current time).
    
    Parameters:
    
    maxTimestampDifference - Max timestamp difference in seconds
  - getMaxTimestampDifference
```
public Integer getMaxTimestampDifference()
```
    Get maximum allowable timestamp difference
    
    Returns:
    
    Difference in seconds, or null if unset
  - setDeferGeoIpResolution
```
public void setDeferGeoIpResolution(Boolean deferGeoIpResolution)
```
    Set defer GeoIP resolution
    If set, GeoIP resolution on events will not actually occur until a GeoIP related field is read. Otherwise, it will occur immediately when a source address field is set if GeoIP is enabled.
    
    Parameters:
    
    deferGeoIpResolution - Boolean
  - getDeferGeoIpResolution
```
public Boolean getDeferGeoIpResolution()
```
    Get defer GeoIP resolution setting
    
    Returns:
    
    Boolean
  - setUseProxyXff
```
public void setUseProxyXff(Boolean useProxyXff)
```
    Set enable proxy xff
    If set, preprocesses the remote addr chain based on proxy header presence.
    
    Parameters:
    
    useProxyXff - Boolean
  - getUseProxyXff
```
public Boolean getUseProxyXff()
```
    Get whether to use the proxy header to select ip from XFF
    
    Returns:
    
    whether the proxy xff setting is enabled
  - setUseXffAsRemote
```
public void setUseXffAsRemote(Boolean xffAsRemote)
```
    Parse the X-Forwarded-For header instead of the remote addr
    If set, parse XFF header, if present, in supported message types and enable usage of the XFF header. This is explicitly enabled to support inconsistent log formats where multiple IPs may also be used in remote addr fields.
    
    Parameters:
    
    xffAsRemote - Boolean
  - getUseXffAsRemote
```
public Boolean getUseXffAsRemote()
```
    Get Use Xff Header as Remote
    
    Returns:
    
    whether an XFF header value overrides remote ip value for supported event types

Class ParserCfg

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Constructor Detail

ParserCfg

Method Detail

fromInputOptions

setXffAddressSelector

getXffAddressSelector

getXffAddressSelectorAsCidrUtil

getMaxmindCityDbPath

setMaxmindCityDbPath

getMaxmindIspDbPath

setMaxmindIspDbPath

getIdentityManagerPath

setIdentityManagerPath

getParserFastMatcher

setParserFastMatcher

getUseEventTimestamp

setUseEventTimestamp

getStackdriverLabelFilters

setStackdriverLabelFilters

getStackdriverProjectFilter

setStackdriverProjectFilter

setDisableCloudwatchStrip

getDisableCloudwatchStrip

setDisableMozlogStrip

getDisableMozlogStrip

setMaxTimestampDifference

getMaxTimestampDifference

setDeferGeoIpResolution

getDeferGeoIpResolution

setUseProxyXff

getUseProxyXff

setUseXffAsRemote

getUseXffAsRemote