Skip to content

Instantly share code, notes, and snippets.

@ober
Created May 4, 2016 07:21
Show Gist options
  • Save ober/20b66927fb7b8e8cd12c0f4287e11655 to your computer and use it in GitHub Desktop.
Save ober/20b66927fb7b8e8cd12c0f4287e11655 to your computer and use it in GitHub Desktop.
cleaner way to do this?
(defun parse-ct-contents (x)
(let* ((records (cdr (elt (read-json-gzip-file x) 0)))
(record-size (length records)))
(dolist (x records)
(let* ((event-time (cdr-assoc :EVENT-TIME x))
(user-identity (cdr-assoc :USER-IDENTITY x))
(user-name (cdr-assoc :USER-NAME user-identity))
(user-key (cdr-assoc :ACCESS-KEY-ID user-identity))
;;(user-identity (cdr-assoc :ACCESS-KEY-ID (cdr-assoc :USER-IDENTITY x)))
(event-name (cdr-assoc :EVENT-NAME x))
(etime5 (get-internal-real-time))
(user-agent (cdr-assoc :USER-AGENT x))
(ip (cdr-assoc :SOURCE-+IP+-ADDRESS x))
(hostname (get-hostname-by-ip ip)))
(normalize-insert nil event-time user-name user-key event-name user-agent (or hostname ip))))))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment