console/filter: let parser tells us if we need the main table or not

This is more robust this way. We also introduce the ability to reverse
the direction of a filter.
This commit is contained in:
Vincent Bernat
2022-08-04 18:32:44 +02:00
parent 2610bd48d1
commit 1aa260bae2
13 changed files with 322 additions and 193 deletions

View File

@@ -12,10 +12,7 @@ import (
"time"
)
var (
addressOrPortRegexp = regexp.MustCompile(`\b(?:Src|Dst)(?:Port|Addr)\b`)
resolutionRegexp = regexp.MustCompile(`{resolution->(\d+)}`)
)
var resolutionRegexp = regexp.MustCompile(`{resolution->(\d+)}`)
// flowsTable describe a consolidated or unconsolidated flows table.
type flowsTable struct {
@@ -29,14 +26,14 @@ type flowsTable struct {
// should contain `{table}` which will be replaced by the appropriate
// flows table and {timefilter} which will be replaced by the
// appropriate time filter.
func (c *Component) queryFlowsTable(query string, start, end time.Time, targetResolution time.Duration) string {
func (c *Component) queryFlowsTable(query string, mainTableRequired bool, start, end time.Time, targetResolution time.Duration) string {
c.flowsTablesLock.RLock()
defer c.flowsTablesLock.RUnlock()
// Select table
table := "flows"
resolution := time.Second
if !addressOrPortRegexp.MatchString(query) {
if !mainTableRequired {
// We can use the consolidated data. The first
// criteria is to find the tables matching the time
// criteria.