soprasteria/cybersecurity-miw

Cybersecurity Mobile Investigation Workstation, a C++ Map-Reduce for Log Analysis

cybersecurity-miw's Issues

Miw is freezing on a simple case

My goal is to count per user, the average of the second value

Here is my exemple of log file I used sample.log

user 1000
user 500

{
    "format_name":"test",
    "delims":" \"",
    "quotechar":"",
    "fields":[
        {
            "name":"user",
            "pos":0,
            "type":"string",
            "key": true
        },
        {
            "name":"rbytes",
            "pos":1,
            "type":"int",
            "aggregated":true,
            "aggregation":"mean"
        }
    ]
}

The command I run

miw -fnames sample.log -ofname test.csv -format_name ../formats/test -output_format csv
files=./data/one.log
I0411 16:30:39.882609  4253 job.cc:122] files size=1
I0411 16:30:39.882654  4253 job.cc:127] Processing file=sample.log

miw seems frozen, it should be a quick computing

Support for regex filtering

Typically, something like filter_type:regex, filter_expr:"your regex expr".

Link error on cppnetlib-uri parse on Ubuntu 15.10

Building on Ubuntu 15.10 with gcc 5.2.1 end up in the following link error:
cybersecurity-miw/miw/.libs/libmiw.so: undefined reference to `boost::network::uri::detail::parse(__gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, __gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, boost::network::uri::detail::uri_parts<__gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits, std::allocator > > >&)'

wc binary conflict with system one

There is a binary named wc in miw (app/wc).
On a make install, wc is deployed in /usr/local/bin.

The problem is in most environment there is already a wc binary and it makes a conflict with the native one.

miw is slow when using match_file