Also, since the if-else tree is growing to be quite large, perhaps it could be refactored as such:
- Each EventType will provide a SyslogMessage
- EventType is responsible for checking that the incoming Event is applicable
This way the if-else tree can be split among the EventTypes and make it more maintainable.
So if I understood this correctly:
Option 1:
A check would be done in NLFPlugin.syslogMessage to the
final JsonObject jsonObject = parsedEvent.asJsonStructure().asJsonObject();
if (
jsonObject.containsKey("Type") && jsonObject.get("Type").getValueType().equals(JsonValue.ValueType.STRING)
) {
...
as it is currently, checking which field is found, and then instead of adding a new EventType object to the List, the EventType object would be responsible for providing a SyslogMessage of itself (and returning that via a new singleton List)?
Though there is the Plugin interface from AKV_01, which wants the SyslogMessages as a List, but the implementations so far have been done with the intention of only a single SyslogMessage per ParsedEvent
Option 2:
EventType is responsible for checking that the incoming Event is applicable
Somehow all of the EventTypes should be initialized with the ParsedEvent, and assume that at least one of them will recognize the format that its in?
Originally posted by @MoonBow-1 in #78 (comment)
Option 2, but most likely the ParsedEvent would be provided in a method call instead of ctor.
Anyways, should be for another issue / pull request.
Originally posted by @eemhu in #78 (comment)
So if I understood this correctly:
Option 1:
A check would be done in
NLFPlugin.syslogMessageto theas it is currently, checking which field is found, and then instead of adding a new EventType object to the List, the EventType object would be responsible for providing a SyslogMessage of itself (and returning that via a new singleton List)?
Though there is the
Plugininterface from AKV_01, which wants the SyslogMessages as a List, but the implementations so far have been done with the intention of only a single SyslogMessage per ParsedEventOption 2:
Somehow all of the EventTypes should be initialized with the ParsedEvent, and assume that at least one of them will recognize the format that its in?
Originally posted by @MoonBow-1 in #78 (comment)
Option 2, but most likely the ParsedEvent would be provided in a method call instead of ctor.
Anyways, should be for another issue / pull request.
Originally posted by @eemhu in #78 (comment)