Add data type counter to storage #5017
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
One line description of pull request
Add a new
data_type_countattribute container for data types into the storage file.Description:
(Note that this MR is part of #5016)
Data type can be used as en Event Filter expression in
psort.py. However, there is no way, without any a posteriori knowledge, to know what actual values can be used in the expression. Adding data type counter into the storage file and printing them with pinfo will allow user to do it.With the patch, the
textoutput format, the output looks like:The
markdownformat:And the
json(pretty-printed withjq):{ ... "storage_counters": { "data_types": { "fs:stat": 3, "total": 17, "apache:access_log:entry": 14 }, "parsers": { "filestat": 3, "total": 17, "apache_access": 14 }, "event_labels": {}, "warnings_by_parser": { "text/apache_access": 1 }, "warnings_by_path_spec": { "type: OS, location: /plaso/test_data/apache_access.log\n": 1 }, "analysis_reports": {} } }The MR has currently no test but I'm willing to work on it if you agree with the changes. Note that the storage file format version must be updated as the schema changed. Also, I would rather rewrite some part of this MR if #5014 get merged.
Thanks
Notes:
All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.
One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.
Checklist: