Skip to content

Commit

Permalink
Allocate map based on expected field count
Browse files Browse the repository at this point in the history
  • Loading branch information
andrewkroh committed Nov 15, 2022
1 parent bd22108 commit 1d35407
Showing 1 changed file with 14 additions and 1 deletion.
15 changes: 14 additions & 1 deletion x-pack/filebeat/processors/aws_vpcflow/parse_aws_vpc_flow_log.go
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ type processor struct {
config
fields []vpcFlowField
log *logp.Logger
originalFieldCount int
expectedIPCount int
}

Expand Down Expand Up @@ -69,9 +70,21 @@ func newParseAWSVPCFlowLog(c config) (*processor, error) {
}
}

originalFieldCount := len(fields)
if c.Mode == ecsMode {
for _, f := range fields {
// If an ECS mapping exists then ECS mode will not include the
// original field.
if len(f.ECSMappings) > 0 {
originalFieldCount--
}
}
}

return &processor{
config: c,
fields: fields,
originalFieldCount: originalFieldCount,
expectedIPCount: ipCount,
log: log,
}, nil
Expand Down Expand Up @@ -117,7 +130,7 @@ func (p *processor) run(event *beat.Event) error {
relatedIPs = make([]string, 0, p.expectedIPCount)
}

originalFields := make(mapstr.M, len(p.fields))
originalFields := make(mapstr.M, p.originalFieldCount)

// Iterate over the substrings in the source string and apply type
// conversion and then ECS mappings.
Expand Down

0 comments on commit 1d35407

Please sign in to comment.