嵌套规则

规则嵌套原型

image.png

关系运算符

and or not

image.png

运算符

大于 小于 大于或者等于 小于或者等于 match in 。。。

工具

JsonParser || jsonPath

格式定义

{
    "relation":"and",
    "terms":[
        {
            "field":"severity",
            "operator":"gt",
                        "type":"int",
            "value":"1"
        },
        {
            "field":"alert_class",
            "operator":"range",
                        "type":"int",
            "value":"[1,3]"
        }
    ],
    "childNode": {
        "relation":"or",
        "terms":[
            {
                "field":"alert.pin",
                "operator":"eq",
                                 "type":"string",
                "value":"wangjinsong-1"
            },
            {
                "field":"alert.pin",
                "operator":"eq",
                                "type":"string",
                "value":"wangjinsong-2"
            }
        ],
        "childNode":{
        }
    }
}

code

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.alibaba.fastjson.JSONPath;
import com.jayway.jsonpath.JsonPath;

import java.util.List;

public class Main {

    public static void main(String[] args) {
        String info = "{\"relation\":\"and\",\"terms\":[{\"field\":\"severity\",\"operator\":\"gt\",\"type\":\"int\",\"value\":\"1\"},{\"field\":\"alert_class\",\"operator\":\"range\",\"type\":\"int\",\"value\":\"1\"}],\"ruleTree\":{\"relation\":\"or\",\"terms\":[{\"field\":\"alert.pin1\",\"operator\":\"eq\",\"type\":\"string\",\"value\":\"wangjinsong-1\"},{\"field\":\"alert.pin2\",\"operator\":\"eq\",\"type\":\"string\",\"value\":\"wangjinsong-2\"}],\"ruleTree\":{\"relation\":\"and\",\"terms\":[{\"field\":\"alert.pin3\",\"operator\":\"eq\",\"type\":\"string\",\"value\":\"wangjinsong-3\"},{\"field\":\"alert.pin4\",\"operator\":\"eq\",\"type\":\"string\",\"value\":\"wangjinsong-4\"}]}}}";
        String log = "{\"severity\":1,\"alert\":{\"pin\":\"wangjinsong-11\",\"pin1\":\"wangjinsong-11\",\"pin2\":\"wangjinsong-22\",\"pin3\":\"wangjinsong-3\",\"pin4\":\"wangjinsong-14\"},\"alert_class\":1}";
        RuleTree ruleTree = JSON.parseObject(info, RuleTree.class);
        boolean ret = exec(ruleTree, log);
        System.err.println("result is " + ret);
    }

    private static boolean exec(RuleTree ruleTree, String log) {
        if (ruleTree != null) {
            RuleTree childRuleTree = ruleTree.getRuleTree();
            String relation = ruleTree.getRelation();
            List<Term> terms = ruleTree.getTerms();
            boolean execRet = exec(childRuleTree, log);
            boolean execTermRet = execTerms(relation, terms, log);
            if ("and".equals(relation)) {
                return execTermRet && execRet;
            } else {
                return execTermRet || execRet;
            }
        }
        return false;
    }

    private static boolean execTerms(String relation, List<Term> terms, String log) {
        if (terms != null) {
            for (Term term : terms) {
                String filed = term.getField();
                String ret = JsonPath.read(log, "$." + filed).toString();
                String operator = term.getOperator();
                String type = term.getType();
                String value = term.getValue();
                System.err.println(relation + ">>>" + filed + ">>>>" + value + ">>>>" + ret);
                if ("or".equals(relation)) {
                    if (ret != null && ret.equals(value)) {
                        return true;
                    }
                } else if ("and".equals(relation)) {
                    if (ret == null || !ret.equals(value)) {
                         return false;
                     }
                }
            }
        }
        if ("or".equals(relation)) {
            return false;
        } else if ("and".equals(relation)) {
            return true;
        } else {
            return false;
        }
    }
}

class RuleTree {
    private String relation;
    private List<Term> terms;
    private RuleTree ruleTree;

    public void setRelation(String relation) {
        this.relation = relation;
    }

    public void setRuleTree(RuleTree ruleTree) {
        this.ruleTree = ruleTree;
    }

    public void setTerms(List<Term> terms) {
        this.terms = terms;
    }

    public List<Term> getTerms() {
        return terms;
    }

    public RuleTree getRuleTree() {
        return ruleTree;
    }

    public String getRelation() {
        return relation;
    }
}

class Term {
    private String field;
    private String operator;
    private String type;
    private String value;

    public String getField() {
        return field;
    }

    public void setField(String field) {
        this.field = field;
    }

    public String getOperator() {
        return operator;
    }

    public void setOperator(String operator) {
        this.operator = operator;
    }

    public String getType() {
        return type;
    }

    public void setType(String type) {
        this.type = type;
    }

    public String getValue() {
        return value;
    }

    public void setValue(String value) {
        this.value = value;
    }
}