Add poc for post filter. See #551

phaag · Aug 6, 2024 · a29354c · a29354c
1 parent aef51ae
commit a29354c
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 2 deletions.
diff --git a/src/nfdump/nfdump.c b/src/nfdump/nfdump.c
@@ -712,6 +712,7 @@ int main(int argc, char **argv) {
     uint32_t limitRecords;
     char Ident[IDENTLEN];
     flist_t flist = {0};
+    void *postFilter = NULL;
 
 #ifdef DEVEL
     long nprocs = sysconf(_SC_NPROCESSORS_ONLN);
@@ -753,7 +754,7 @@ int main(int argc, char **argv) {
 
     Ident[0] = '\0';
     int c;
-    while ((c = getopt(argc, argv, "6aA:Bbc:C:D:E:G:s:gH:hn:i:jf:qyz::r:v:w:J:M:NImO:R:XZt:TVv:W:x:o:")) != EOF) {
+    while ((c = getopt(argc, argv, "6aA:Bbc:C:D:E:G:s:gH:hn:i:jf:qyz::r:v:w:J:M:NImO:P:R:XZt:TVv:W:x:o:")) != EOF) {
         switch (c) {
             case 'h':
                 usage(argv[0]);
@@ -926,6 +927,10 @@ int main(int argc, char **argv) {
                     exit(EXIT_FAILURE);
                 }
             } break;
+            case 'P': {  // stat order by
+                CheckArgLen(optarg, 256);
+                postFilter = strdup(optarg);
+            } break;
             case 'R':
                 CheckArgLen(optarg, MAXPATHLEN);
                 if (!flist.multiple_files) {
@@ -1047,8 +1052,17 @@ int main(int argc, char **argv) {
     void *engine = CompileFilter(filter);
     if (!engine) exit(254);
 
+    if (postFilter) {
+        outputParams->postFilter = CompileFilter(postFilter);
+        if (!outputParams->postFilter) exit(254);
+    }
+
     if (fdump) {
         DumpEngine(engine);
+        if (outputParams->postFilter) {
+            printf("\nPost filter:\n");
+            DumpEngine(outputParams->postFilter);
+        }
         exit(EXIT_SUCCESS);
     }
 

diff --git a/src/nfdump/nflowcache.c b/src/nfdump/nflowcache.c
@@ -49,6 +49,7 @@
 #include "blocksort.h"
 #include "config.h"
 #include "exporter.h"
+#include "filter/filter.h"
 #include "maxmind/maxmind.h"
 #include "memhandle.h"
 #include "nfdump.h"
@@ -1582,6 +1583,10 @@ static inline void PrintSortList(SortElement_t *SortList, uint32_t maxindex, out
                                  RecordPrinter_t print_record, int ascending) {
     dbg_printf("Enter %s\n", __func__);
 
+    if (outputParams->postFilter) {
+        FilterSetParam(outputParams->postFilter, "out", outputParams->hasGeoDB);
+    }
+
     int max = maxindex;
     if (outputParams->topN && outputParams->topN < maxindex) max = outputParams->topN;
     for (int i = 0; i < max; i++) {
@@ -1618,7 +1623,11 @@ static inline void PrintSortList(SortElement_t *SortList, uint32_t maxindex, out
             SwapRawFlow(genericFlow, ipv4Flow, ipv6Flow, flowMisc, cntFlow, asRouting);
         }
 
-        print_record(stdout, &recordHandle, outputParams->doTag);
+        if (outputParams->postFilter) {
+            if (FilterRecord(outputParams->postFilter, &recordHandle)) print_record(stdout, &recordHandle, outputParams->doTag);
+        } else {
+            print_record(stdout, &recordHandle, outputParams->doTag);
+        }
     }
 
 }  // End of PrintSortList

diff --git a/src/output/output.h b/src/output/output.h
@@ -50,6 +50,7 @@ typedef struct outputParams_s {
     bool hasTorDB;
     outputMode_t mode;
     int topN;
+    void *postFilter;
 } outputParams_t;
 
 RecordPrinter_t SetupOutputMode(char *print_format, outputParams_t *outputParams);