fix: cifv3 parser broken for ES backend instances (#275)

* fix cifv3 parser

* fix cifv3 parser

csirtg_smrt/parser/zcifv3.py

@@ -1,10 +1,14 @@
 import copy
 import json
 from csirtg_smrt.parser import Parser
+from cifsdk.constants import PYVERSION
 import logging
 import os
 from pprint import pprint
 
+if PYVERSION == 3:
+    basestring = (str, bytes)
+
 TRACE = os.environ.get('CSIRTG_SMRT_PARSER_TRACE')
 
 logger = logging.getLogger(__name__)
@@ -21,23 +25,17 @@ def __init__(self, *args, **kwargs):
 
     def process(self):
         defaults = self._defaults()
-        map = self.rule.feeds[self.feed].get('map')
         values = self.rule.feeds[self.feed].get('values')
         envelope = self.rule.feeds[self.feed].get('envelope')
 
-        try:
-            basestring
-        except NameError:
-            basestring = str
-
         for l in self.fetcher.process():
             try:
                 l = json.loads(l)
             except ValueError as e:
                 logger.error('json parsing error: {}'.format(e))
                 continue
-            if l.get('data') and isinstance(l['data'], basestring) and l['data'].startswith(
-                    '{"hits":{"hits":[{"_source":'):
+
+            if l.get('data') and isinstance(l['data'], basestring) and l['data'].startswith('{"hits":{"hits":[{"_source":'):
                 l['data'] = json.loads(l['data'])
                 l['data'] = [r['_source'] for r in l['data']['hits']['hits']]
 
@@ -46,13 +44,19 @@ def process(self):
 
             if l.get('data') != '{}':
                 for e in l['data']:
+                    if isinstance(e['group'], list):
+                        e['group'] = e['group'][0]
+
                     i = copy.deepcopy(defaults)
-                    if map:
-                        for x, c in enumerate(map):
-                            i[values[x]] = e[c]
+
+                    if values:
+                        for value in values:
+                            i[value] = e[value]
+                    else:
+                        for value in e.keys():
+                            i[value] = e[value]
                     yield i
             else:
                 return
 
 Plugin = cifv3
-