OCI split data in different tables

Solutions/Oracle Cloud Infrastructure/Data Connectors/AzureFunctionOCILogs/main.py

@@ -53,6 +53,25 @@
     process_events(stream_client, StreamOcid, cursor, limit, sentinel_connector, start_ts)
     logging.info(f'Function finished. Sent events {sentinel_connector.successfull_sent_events_number}.')
 
+
+def determine_log_type(event):
+    """
+    Determine the Azure Sentinel log type based on the event type.
+    """
+    event_type = event.get("type", "default")
+    if "com.oraclecloud.loadbalancer" in event_type:
+        return "OCI_LoadBalancerLogs"
+    # elif event_type == "com.oraclecloud.loadbalancer.error":
+    #     return "OCI_LoadBalancerLogs"
+    elif "com.oraclecloud.audit" in event_type:
+        return "OCI_AuditLogs"
+    elif "com.oraclecloud.virtualNetwork" in event_type:
+        return "OCI_VirtualNetworkLogs"
+    elif "com.oraclecloud.compute" in event_type:
+        return "OCI_ComputeInstanceLogs"
+    else:
+        return "OCI_Logs"  # Default log type
+
 def parse_key(key_input):
     try:
         begin_line = re.search(r'-----BEGIN [A-Z ]+-----', key_input).group()
@@ -127,6 +146,8 @@
                 #if event != 'ok' and event != 'Test': 
                     event = json.loads(event)
                     if "data" in event:
+                        # Determine table based on event type
+                        log_type = determine_log_type(event)
                         if "request" in event["data"] and event["type"] != "com.oraclecloud.loadbalancer.access":
                             if event["data"]["request"] is not None and "headers" in event["data"]["request"]:
                                 event["data"]["request"]["headers"] = json.dumps(event["data"]["request"]["headers"])
@@ -143,6 +164,7 @@
                             if event["data"]["stateChange"] is not None and "current" in event["data"]["stateChange"] :
                                 event["data"]["stateChange"]["current"] = json.dumps(
                                     event["data"]["stateChange"]["current"])
+                    sentinel.log_type = log_type
                     sentinel.send(event)
 
         sentinel.flush()