|
@@ -53,7 +53,7 @@ var apiFieldMappings = map[string]map[string]FieldPathConfig{
|
|
|
"RuleID": {Paths: []string{"ruleId", "data.ruleId", "ids", "data.ids"}, FieldType: "array_int"},
|
|
|
},
|
|
|
"CC": {
|
|
|
- "AllowAndDenyIps": {Paths: []string{"data.newIp","data.ips", "ip", "ips","newIp", "data.ip" }},
|
|
|
+ "AllowAndDenyIps": {Paths: []string{"ips","newIp", "data.newIp","data.ips", "ip", "data.ip" }},
|
|
|
"RuleID": {Paths: []string{"ruleId", "data.ruleId", "ids", "data.ids"}, FieldType: "array_int"},
|
|
|
},
|
|
|
// "分配网关组" 的日志通常不包含用户层面的业务数据,所以这里不定义
|
|
@@ -105,7 +105,7 @@ func (s *wafLogDataCleanService) ParseWafLogExtraData(extraDataBytes json.RawMes
|
|
|
// 根据 apiName 找到对应的字段映射配置
|
|
|
var fieldConfig map[string]FieldPathConfig
|
|
|
for keyword, config := range apiFieldMappings {
|
|
|
- if strings.Contains(strings.ToLower(apiName), keyword) {
|
|
|
+ if strings.Contains(apiName, keyword) {
|
|
|
fieldConfig = config
|
|
|
break
|
|
|
}
|