tuning (#280)

* remove unnecessary to_string

* remove unnecessary RWLock

* change hashmap crate

* remove unneccesarry to_string

* fmt

* remove rustc warning

* remove unnecessary to_string

* remove unnecessary comment

* remove unused functions

* remove unneccesary code.

* change compile option

* fmt

* remove unneccesarry split

* fmt

* remove unneccesary Option

src/detections/utils.rs

@@ -105,43 +105,41 @@ pub fn get_serde_number_to_string(value: &serde_json::Value) -> Option<String> {
     }
 }
 
-// alias.txtについて、指定されたevent_keyに対応するaliasを取得します。
-pub fn get_alias(event_key: &String) -> Option<String> {
-    let conf = configs::CONFIG.read().unwrap();
-    let keyvalues = &conf.event_key_alias_config.get_event_key_values();
-    let value = keyvalues
-        .iter()
-        .find(|(_, cur_event_key)| &event_key == cur_event_key);
-
-    if value.is_none() {
-        return Option::None;
-    } else {
-        return Option::Some(value.unwrap().0.clone());
-    }
-}
-
 pub fn get_event_value<'a>(key: &String, event_value: &'a Value) -> Option<&'a Value> {
     if key.len() == 0 {
         return Option::None;
     }
-    let singleton = configs::CONFIG.read().unwrap();
-    let event_key = match singleton
-        .event_key_alias_config
-        .get_event_key(key.to_string())
-    {
-        Some(alias_event_key) => alias_event_key,
-        None => key,
-    };
 
-    let mut ret: &Value = event_value;
-    for key in event_key.split(".") {
-        if ret.is_object() == false {
-            return Option::None;
+    let event_key = configs::EVENTKEY_ALIAS.get_event_key(key);
+    if let Some(event_key) = event_key {
+        let mut ret: &Value = event_value;
+        // get_event_keyが取得できてget_event_key_splitが取得できないことはない
+        let splits = configs::EVENTKEY_ALIAS.get_event_key_split(key);
+        let mut start_idx = 0;
+        for key in splits.unwrap() {
+            if ret.is_object() == false {
+                return Option::None;
+            }
+
+            let val = &event_key[start_idx..(*key + start_idx)];
+            ret = &ret[val];
+            start_idx = *key + start_idx;
+            start_idx += 1;
         }
-        ret = &ret[key];
-    }
 
-    return Option::Some(ret);
+        return Option::Some(ret);
+    } else {
+        let mut ret: &Value = event_value;
+        let event_key = key;
+        for key in event_key.split(".") {
+            if ret.is_object() == false {
+                return Option::None;
+            }
+            ret = &ret[key];
+        }
+
+        return Option::Some(ret);
+    }
 }
 
 pub fn get_thread_num() -> usize {