unsiemly.xforms
Data transformation tools useful for SIEMs. Usually this is about format conversion (e.g. seconds-since-epoch to ISO8601) or flattening data (e.g. turning a map into a string).
Typically, you'll compose some of these functions and then use something like specter or update/update-in to apply them to maps.
Data transformation tools useful for SIEMs. Usually this is about format conversion (e.g. seconds-since-epoch to ISO8601) or flattening data (e.g. turning a map into a string). Typically, you'll compose some of these functions and then use something like specter or update/update-in to apply them to maps.
->iso8601clj
(->iso8601 instant)Given a timestamp, parse it to an ISO8601 timestamp.
This is for many reasons, but one important one is that ElasticSearch will recognize these as date fields with no configuration.
Given a timestamp, parse it to an ISO8601 timestamp. This is for many reasons, but one important one is that ElasticSearch will recognize these as date fields with no configuration.
defproxytypecljmacro
(defproxytype type-name iface-sym)Creates a type with given name that implements only the given interface. The type will have one constructor, taking an object that implements the same interface. Instances of this type will proxy the instance you give it, exposing only the behavior of that interface.
This is useful when you have an object implementing multiple interfaces A, B... and you need to interact with some code that does bogus type checking in the wrong order (e.g. checking if it's a B first when you want it to act like an A). So, create a proxy type for A, wrap your x in the proxy type, and now you have x-except-only-looks-like-an-A.
This uses deftype internally so you'll also get a ->TypeName fn for free.
To see why this is necessary:
Creates a type with given name that implements only the given interface. The type will have one constructor, taking an object that implements the same interface. Instances of this type will proxy the instance you give it, exposing only the behavior of that interface. This is useful when you have an object implementing multiple interfaces A, B... and you need to interact with some code that does bogus type checking in the wrong order (e.g. checking if it's a B first when you want it to act like an A). So, create a proxy type for A, wrap your x in the proxy type, and now you have x-except-only-looks-like-an-A. This uses deftype internally so you'll also get a ->TypeName fn for free. To see why this is necessary: - https://github.com/latacora/unsiemly/issues/11 - https://github.com/GoogleCloudPlatform/google-cloud-java/issues/2432
epoch-millis->clj
(epoch-millis-> millis)Parse a number of milliseconds (as a string or numeric type) to an instant.
Parse a number of milliseconds (as a string or numeric type) to an instant.
insts->iso8601clj
(insts->iso8601 m)Given a nested data structure, find all the leaves that are also time instants, and convert them to iso8601. This will not attempt to be clever and parse e.g. strings to see if they're probably a timestamp (say, ISO8601 or RFC822) -- it's the caller's job to find and parse those first.
Given a nested data structure, find all the leaves that are also time instants, and convert them to iso8601. This will not attempt to be clever and parse e.g. strings to see if they're probably a timestamp (say, ISO8601 or RFC822) -- it's the caller's job to find and parse those first.
jsonify-valclj
(jsonify-val x)Turns complex types into ones StackDriver or BigQuery will understand.
Turns complex types into ones StackDriver or BigQuery will understand.
NESTEDclj
A specter selector for junctions in nested data structures.
This does post-order traversal. That's useful so that if you're going to modify the data structures it finds, that's as efficient as possible.
A specter selector for junctions in nested data structures. This does post-order traversal. That's useful so that if you're going to modify the data structures it finds, that's as efficient as possible.
noniterable-mapsclj
(noniterable-maps x)Finds all maps that are also iterable in the (nested) data structure x, and replace them with zero-copy map replacements that are not also iterable.
For a rationale, see #11.
Finds all maps that are also iterable in the (nested) data structure x, and replace them with zero-copy map replacements that are not also iterable. For a rationale, see #11.
seqs->vecsclj
(seqs->vecs x)Finds all seqs and lists in the nested data structure and turns them into vectors.
Finds all seqs and lists in the nested data structure and turns them into vectors.
stringify-kwclj
(stringify-kw maybe-kw)If something is a keyword, turn it into an (unqualified) string.
See jsonify-val.
If something is a keyword, turn it into an (unqualified) string. See [[jsonify-val]].
TREE-KEYSclj
A specter selector for all of the map keys in a nested tree.
A specter selector for all of the map keys in a nested tree.
TREE-LEAVESclj
A specter selector for all of the leaves in a nested tree.
A specter selector for all of the leaves in a nested tree.
cljdoc is a website building & hosting documentation for Clojure/Script libraries
× close