Question

是指sid, ip_src, ip_dst吗？第148行以`look_for＆＃39;

开头

我尝试使用这些参数删除重复的ips警报。如果我只有一个警报要显示，我不会收到此错误。只要有2个或更多警报，我就会收到此错误。

错误：

wrong number of arguments (3 for 1)

app/controllers/csdashboard_controller.rb:148:in `[]'
app/controllers/csdashboard_controller.rb:148:in `block (2 levels) in index'
app/controllers/csdashboard_controller.rb:147:in `uniq'
app/controllers/csdashboard_controller.rb:147:in `block in index'
app/controllers/csdashboard_controller.rb:131:in `each'
app/controllers/csdashboard_controller.rb:131:in `index'

|添加了进一步说明|

索引视图：

<% if @filtered_snort_detail_query.count > 0 %>
  <table>
      <tr>
        <th>Timestamp</th>
        <th>Tag Info</th>
        <th>Message</th>
      </tr>
      <% @filtered_snort_detail_query.each do |d|
        text_msg = d['_source']['message']
        if d['_source']['message'].nil?
        end
      %>
          <tr>
            <td class='timestamp'><%= d['_source']['@timestamp'].to_time %></td>
            <td class='tags'><%= d['_source']['tags'] %></td>
            <td class='message'><%= text_msg %></td>
          </tr>
      <% end %>

    </table>
<% else %>
    <div> No Results Returned. </div>
<% end %>

|添加了进一步说明|

当我在控制器中使用此代码时，我在视图中收到来自IPS的所有警报：这样做，我可能会收到500个警报，这些警报可以根据签名ID（sid），源IP（ip_src）和目标IP（ip_dst）压缩为1个警报。

if @es_snort_detail_query.count > 0
      @filtered_snort_detail_query = Array.new
      @es_snort_detail_query.each do |ips_detail|
        next if ips_detail['_source']['type'] != 'snort-ips'
        next if ips_detail['_source']['@timestamp'] < @ts
        @filtered_snort_detail_query.push(ips_detail)
      end
 end

这是我尝试使用控制器中的sid, ip_src, ip_dst删除重复警报，但此代码会引发错误：

    if @es_snort_detail_query.count > 0
      sid = Array.new
      ip_src = Array.new
      ip_dst = Array.new
      @filtered_snort_detail_query = Array.new
      @es_snort_detail_query.each do |ips_detail|
        next if ips_detail['_source']['type'] != 'snort-ips'
        next if ips_detail['_source']['@timestamp'] < @ts
        if ips_detail['_source']['message'].nil?
          text_msg = ips_detail['_source']['message']
        else
          text_msg = ips_detail['_source']['message']
        end
        unless text_msg.nil?
          sid_data = text_msg.scan(/\[\d+:\d+:\d+\]/)
          src_ip_data = text_msg.scan(/(?:[0-9]{1,3}\.){3}[0-9]{1,3}/)
          dst_ip_data = text_msg.scan(/(?:[0-9]{1,3}\.){3}[0-9]{1,3}/)
          sid.push(sid_data[0]) unless sid_data[0].nil?
          ip_src.push(src_ip_data[0]) unless src_ip_data[0].nil?
          ip_dst.push(dst_ip_data[1]) unless dst_ip_data[1].nil?

          @filtered_snort_detail_query.push(ips_detail).uniq do |look_for|
            look_for[{:ips_info => sid}, {:ips_info => ip_src}, {:ips_info => ip_dst}]
          end
        end
      end
      end

Answer 1

您正在3中传递look_for个参数：

look_for[{:ips_info => sid}, {:ips_info => ip_src}, {:ips_info => ip_dst}]

当您访问1数组中的特定索引时，它应该是look_for参数。因此，错误。

Ruby：这个错误指的是什么？错误的参数数量（3表示1）

1 个答案: