add support to run mapreduce queries on generic log lines, e.g. count all log lines containing a certain string, such as "ERROR"

3 files changed, 18 insertions, 1 deletions

diff --git a/internal/mapr/logformat/default.go b/internal/mapr/logformat/default.go
index f0df5bc..3178dda 100644
--- a/internal/mapr/logformat/default.go
+++ b/internal/mapr/logformat/default.go
@@ -10,6 +10,9 @@ func (p *Parser) MakeFieldsDEFAULT(maprLine string) (map[string]string, error) {
 	fields := make(map[string]string, 20)
 	splitted := strings.Split(maprLine, "|")
 
+	fields["*"] = "*"
+	fields["$line"] = maprLine
+	fields["$empty"] = ""
 	fields["$hostname"] = p.hostname
 
 	for _, kv := range splitted {
diff --git a/internal/mapr/logformat/generic.go b/internal/mapr/logformat/generic.go
new file mode 100644
index 0000000..9102c0b
--- /dev/null
+++ b/internal/mapr/logformat/generic.go
@@ -0,0 +1,13 @@
+package logformat
+
+// MakeFieldsGENEROC is the generic log line parser.
+func (p *Parser) MakeFieldsGENERIC(maprLine string) (map[string]string, error) {
+	fields := make(map[string]string, 3)
+
+	fields["*"] = "*"
+	fields["$hostname"] = p.hostname
+	fields["$line"] = maprLine
+	fields["$empty"] = ""
+
+	return fields, nil
+}
diff --git a/internal/mapr/logformat/parser.go b/internal/mapr/logformat/parser.go
index 09c706b..4671191 100644
--- a/internal/mapr/logformat/parser.go
+++ b/internal/mapr/logformat/parser.go
@@ -3,10 +3,11 @@ package logformat
 import (
 	"errors"
 	"fmt"
-	"github.com/mimecast/dtail/internal/io/logger"
 	"os"
 	"reflect"
 	"strings"
+
+	"github.com/mimecast/dtail/internal/io/logger"
 )
 
 // Parser is used to parse the mapreduce information from the server log files.