gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 12:42:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

enrich event data for analyze rules

Browse Source
This commit is contained in:
Oliver Kieselbach
2026-04-10 18:28:31 +02:00
parent 625809423f
commit e5c53eb772
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+1 -1
View File
@@ -1 +1 @@
909
910
src/Backend/AutopilotMonitor.Functions/Services/RuleEngine.ConditionEvaluators.cs
+13 -7
View File
@@ -56,7 +56,7 @@ namespace AutopilotMonitor.Functions.Services
if (IsSuppressedByEvent(evt, condition.SuppressByEvent, events))
continue;
return (true, new Dictionary<string, object>
var evidence = new Dictionary<string, object>
{
["eventId"] = evt.EventId,
["sequence"] = evt.Sequence,
@@ -64,7 +64,9 @@ namespace AutopilotMonitor.Functions.Services
["eventType"] = evt.EventType,
["field"] = condition.DataField,
["value"] = fieldValue
});
};
AddDataFieldsToEvidence(evidence, evt, "", "");
return (true, evidence);
}
}
return (false, "data field not matched");
@@ -80,14 +82,16 @@ namespace AutopilotMonitor.Functions.Services
}
var first = matchingEvents[0];
return (true, new Dictionary<string, object>
var existsEvidence = new Dictionary<string, object>
{
["eventId"] = first.EventId,
["sequence"] = first.Sequence,
["timestamp"] = first.Timestamp,
["eventType"] = condition.EventType,
["count"] = matchingEvents.Count
});
};
AddDataFieldsToEvidence(existsEvidence, first, "", "");
return (true, existsEvidence);
}
private (bool matched, object evidence) EvaluateEventDataCondition(RuleCondition condition, List<EnrollmentEvent> events)
@@ -99,14 +103,16 @@ namespace AutopilotMonitor.Functions.Services
var fieldValue = GetDataFieldValue(evt, condition.DataField);
if (fieldValue != null && MatchesOperator(fieldValue, condition.Operator, condition.Value))
{
return (true, new Dictionary<string, object>
var evidence = new Dictionary<string, object>
{
["eventId"] = evt.EventId,
["sequence"] = evt.Sequence,
["timestamp"] = evt.Timestamp,
["field"] = condition.DataField,
["value"] = fieldValue
});
};
AddDataFieldsToEvidence(evidence, evt, "", "");
return (true, evidence);
}
}
@@ -572,7 +578,7 @@ namespace AutopilotMonitor.Functions.Services
{
if (evt.Data == null) return;
var knownFields = new[] { "appId", "appName", "errorPatternId", "errorDetail", "errorCode", "status" };
var knownFields = new[] { "appId", "appName", "errorPatternId", "errorDetail", "errorCode", "exitCode", "status" };
foreach (var field in knownFields)
{