41e763ad02
- Remove CorrelationKeyFull() alias, use CorrelationKey() everywhere - Remove duplicate TimeProvider interface from ports/source.go - Remove unused time import from ports/source.go - Update README.md: replace ./build.sh and ./test.sh with make commands - Update RPM package names in README to match current version (1.0.3) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
33 lines
725 B
Go
33 lines
725 B
Go
package domain
|
|
|
|
import (
|
|
"strconv"
|
|
"time"
|
|
)
|
|
|
|
// EventSource identifies the source of an event.
|
|
type EventSource string
|
|
|
|
const (
|
|
SourceA EventSource = "A" // Apache/HTTP source
|
|
SourceB EventSource = "B" // Network source
|
|
)
|
|
|
|
// NormalizedEvent represents a unified internal event from either source.
|
|
type NormalizedEvent struct {
|
|
Source EventSource
|
|
Timestamp time.Time
|
|
SrcIP string
|
|
SrcPort int
|
|
DstIP string
|
|
DstPort int
|
|
Headers map[string]string
|
|
Extra map[string]any
|
|
Raw map[string]any // Original raw data
|
|
}
|
|
|
|
// CorrelationKey returns the key used for correlation (src_ip + src_port).
|
|
func (e *NormalizedEvent) CorrelationKey() string {
|
|
return e.SrcIP + ":" + strconv.Itoa(e.SrcPort)
|
|
}
|