@@ -30,45 +30,45 @@ var ec2InstanceRegexp = sync.OnceValue(func() *regexp.Regexp {
3030 return regexp .MustCompile (`^arn:aws:sts::.*?:assumed-role/(?P<role>.*?)/(?P<host>i-([0-9a-f]{8}|[0-9a-f]{17}))$` )
3131})
3232
33- func decodeCloudTrail (r io.Reader ) iter.Seq [s3Record ] {
34- return func (yield func (s3Record ) bool ) {
33+ func decodeCloudTrail (r io.Reader ) iter.Seq2 [s3Record , error ] {
34+ return func (yield func (s3Record , error ) bool ) {
3535 gz , err := gzip .NewReader (r )
3636 if err != nil {
37- yield (s3Record {Err : fmt .Errorf ("decode cloudtrail gzip: %w" , err )} )
37+ yield (s3Record {}, fmt .Errorf ("decode cloudtrail gzip: %w" , err ))
3838 return
3939 }
4040 defer gz .Close () //nolint:errcheck
4141
4242 dec := json .NewDecoder (gz )
4343
4444 if t , err := dec .Token (); err != nil || t != json .Delim ('{' ) {
45- yield (s3Record {Err : errors .New ("decode cloudtrail: expected '{' at start of JSON" )} )
45+ yield (s3Record {}, errors .New ("decode cloudtrail: expected '{' at start of JSON" ))
4646 return
4747 }
4848 if t , err := dec .Token (); err != nil || t != "Records" {
49- yield (s3Record {Err : errors .New ("decode cloudtrail: expected 'Records' key" )} )
49+ yield (s3Record {}, errors .New ("decode cloudtrail: expected 'Records' key" ))
5050 return
5151 }
5252 if t , err := dec .Token (); err != nil || t != json .Delim ('[' ) {
53- yield (s3Record {Err : errors .New ("decode cloudtrail: expected '[' at start of Records array" )} )
53+ yield (s3Record {}, errors .New ("decode cloudtrail: expected '[' at start of Records array" ))
5454 return
5555 }
5656
5757 for dec .More () {
5858 var record map [string ]any
5959 if err := dec .Decode (& record ); err != nil {
60- yield (s3Record {Err : fmt .Errorf ("decode cloudtrail record: %w" , err )} )
60+ yield (s3Record {}, fmt .Errorf ("decode cloudtrail record: %w" , err ))
6161 return
6262 }
6363
6464 msg , err := json .Marshal (record )
6565 if err != nil {
66- yield (s3Record {Err : fmt .Errorf ("marshal cloudtrail record: %w" , err )} )
66+ yield (s3Record {}, fmt .Errorf ("marshal cloudtrail record: %w" , err ))
6767 return
6868 }
6969
7070 host := cloudtrailHost (record )
71- if ! yield (s3Record {Message : string (msg ), Host : host }) {
71+ if ! yield (s3Record {Message : string (msg ), Host : host }, nil ) {
7272 return
7373 }
7474 }
@@ -98,7 +98,7 @@ func cloudtrailHost(record map[string]any) string {
9898 re := ec2InstanceRegexp ()
9999 matches := re .FindStringSubmatch (arn )
100100 if matches == nil {
101- slog .Debug (arn + " arn did not match, cloudtrail host extraction skipped" )
101+ slog .Debug (arn + " arn did not match an EC2 host instance , cloudtrail host extraction skipped" )
102102 return ""
103103 }
104104
0 commit comments