package com.opensoc.parsing.parsers;

import java.io.UnsupportedEncodingException;

import org.json.simple.JSONObject;
import org.json.simple.parser.JSONParser;
import org.json.simple.parser.ParseException;

public class BasicLogstashParser extends AbstractParser {

	@Override
	public JSONObject parse(byte[] raw_message) {
		
		try {
			
			/*
			 * We need to create a new JSONParser each time because its 
			 * not serializable and the parser is created on the storm nimbus
			 * node, then transfered to the workers.
			 */
			JSONParser jsonParser = new JSONParser();
			String rawString = new String(raw_message, "UTF-8");
			JSONObject rawJson = (JSONObject) jsonParser.parse(rawString);
			
			// remove logstash meta fields
			rawJson.remove("@vesrion");
			rawJson.remove("type");
			rawJson.remove("host");
			
			// rename other keys
			rawJson = mutate(rawJson, "@timestamp", "timestamp");
			rawJson = mutate(rawJson, "message", "original_string");
			rawJson = mutate(rawJson, "src_ip", "ip_src_addr");
			rawJson = mutate(rawJson, "dst_ip", "ip_dst_addr");
			rawJson = mutate(rawJson, "src_port", "ip_src_port");
			rawJson = mutate(rawJson, "dst_port", "ip_dst_port");
			rawJson = mutate(rawJson, "src_ip", "ip_src_addr");

			return rawJson;
		} catch (Exception e) {
			e.printStackTrace();
			return null;
		}
		
	}
	
	private JSONObject mutate(JSONObject json, String oldKey, String newKey) {
		if (json.containsKey(oldKey)) {
			json.put(newKey, json.remove(oldKey));
		}
		return json;
	}

}

@@ -75,16 +75,51 @@
 ception;
+%0Aimport java.text.SimpleDateFormat;
 %0A%0Aimport
@@ -785,18 +785,18 @@
 ove(%22@ve
-s
 r
+s
 ion%22);%0A%09
@@ -848,16 +848,43 @@
 host%22);%0A
+%09%09%09rawJson.remove(%22tags%22);%0A
 %09%09%09%0A%09%09%09/
@@ -907,65 +907,8 @@
 eys%0A
-%09%09%09rawJson = mutate(rawJson, %22@timestamp%22, %22timestamp%22);%0A
 %09%09%09r
@@ -1241,16 +1241,150 @@
 _addr%22);
+%0A%09%09%09%0A%09%09%09// convert timestamp to milli since epoch%0A%09%09%09rawJson.put(%22timestamp%22, LogstashToEpoch((String) rawJson.remove(%22@timestamp%22)));
 %0A%0A%09%09%09ret
@@ -1465,18 +1465,16 @@
 ull;%0A%09%09%7D
-%0A%09
 %09%0A%09%7D%0A%09%0A%09
@@ -1627,16 +1627,17 @@
 y));%0A%09%09%7D
+%09
 %0A%09%09retur
@@ -1646,12 +1646,252 @@
 json;%0A%09%7D
+%0A%09%0A%09private long LogstashToEpoch(String timestamp) throws java.text.ParseException %7B%0A%09%09SimpleDateFormat logstashDateFormat = new SimpleDateFormat(%22yyyy-MM-dd'T'HH:mm:ss.SSS'Z'%22);%0A%09%09return logstashDateFormat.parse(timestamp).getTime();%0A%09%09%0A%09%7D
 %0A%0A%7D%0A

convert timestamps and remove tags in logstash parser