ait-aecid / logdata-anomaly-miner

This tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources and lowest possible permissions to make it suitable for production server use.

GNU General Public License v3.0

79 stars 24 forks source link

Add log line number to AMiner output. #1335

Closed viktorbeck98 closed 1 month ago

viktorbeck98 commented 3 months ago

Make sure these boxes are signed before submitting your Pull Request -- thank you.

Must haves

[x] I have read and followed the contributing guide lines at https://github.com/ait-aecid/logdata-anomaly-miner/wiki/Git-development-workflow
[x] Issues exist for this PR
[x] I added related issues using the "Fixes #"-notations
[x] This Pull-Requests merges into the "development"-branch

Fixes #1334

Submission specific

[ ] This PR introduces breaking changes
[ ] My change requires a change to the documentation
[ ] I have updated the documentation accordingly
[ ] I have added tests to cover my changes
[ ] All new and existing tests passed

Describe changes:

ernstleierzopf commented 1 month ago

not sure if this is the best solution for the issue. Do you want to have one unique identifier for each json object or for each log atom? I think there might be multiple outputs for each log atom. If you want to have one identifier for each log line, this might work.

ernstleierzopf commented 1 month ago

Also the unittests and other tests must be adapted for the new output. Can help with that if needed :)

landauermax commented 1 month ago

I would really suggest to introduce a parameter in the aminer config that allows to switch the line number on and off, because i guess that in some cases (application of the aminer in live data, that has no "beginning" and a line number does not make sense) this information is not desired and will even be confusing.

viktorbeck98 commented 1 month ago

Yes, it should be an identifier for each log line. Best is probably to add a parameter in the aminer config. Thereby, no tests have to be rewritten (if I'm not wrong) because the AMiner output will stay the same for the tests. I'll let you know if I need help (or the failed tests will tell) :)