add mapr aggregration on CSV integr test

2 files changed, 60 insertions, 0 deletions

diff --git a/internal/mapr/logformat/csv.go b/internal/mapr/logformat/csv.go
new file mode 100644
index 0000000..ea85ca9
--- /dev/null
+++ b/internal/mapr/logformat/csv.go
@@ -0,0 +1,53 @@
+package logformat
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/mimecast/dtail/internal/protocol"
+)
+
+type csvParser struct {
+	defaultParser
+	header    []string
+	hasHeader bool
+}
+
+func newCSVParser(hostname, timeZoneName string, timeZoneOffset int) (*csvParser, error) {
+	defaultParser, err := newDefaultParser(hostname, timeZoneName, timeZoneOffset)
+	if err != nil {
+		return &csvParser{}, err
+	}
+	return &csvParser{defaultParser: *defaultParser}, nil
+}
+
+func (p *csvParser) MakeFields(maprLine string) (map[string]string, error) {
+	if !p.hasHeader {
+		p.parseHeader(maprLine)
+		return nil, ErrIgnoreFields
+	}
+
+	fields := make(map[string]string, 7+len(p.header))
+	fields["*"] = "*"
+	fields["$hostname"] = p.hostname
+	fields["$server"] = p.hostname
+	fields["$line"] = maprLine
+	fields["$empty"] = ""
+	fields["$timezone"] = p.timeZoneName
+	fields["$timeoffset"] = p.timeZoneOffset
+
+	splitted := strings.Split(maprLine, protocol.CSVDelimiter)
+	for i, value := range splitted {
+		if i >= len(p.header) {
+			return fields, fmt.Errorf("CSV file seems corrupted, more fields than header values?")
+		}
+		fields[p.header[i]] = value
+	}
+
+	return fields, nil
+}
+
+func (p *csvParser) parseHeader(maprLine string) {
+	p.header = strings.Split(maprLine, protocol.CSVDelimiter)
+	p.hasHeader = true
+}
diff --git a/internal/mapr/setcondition.go b/internal/mapr/setcondition.go
index 9dcd690..308a0f4 100644
--- a/internal/mapr/setcondition.go
+++ b/internal/mapr/setcondition.go
@@ -37,6 +37,13 @@ func makeSetConditions(tokens []token) (set []setCondition, err error) {
 			return sc, nil, err
 		}
 
+		// Seems like a quoted string? E.g.: "set $foo = `count(bar)`"
+		// So don't interpret `count` as a function!
+		if tokens[2].quotesStripped {
+			sc.rType = Field
+			return sc, tokens[3:], nil
+		}
+
 		// Seems like a function call?
 		if strings.HasSuffix(sc.rString, ")") {
 			functionStack, functionArg, err := funcs.NewFunctionStack(tokens[2].str)