update(falco): updates usage description for -o, --option

Signed-off-by: Andrea Bonanno <andrea@bonanno.cloud>
falcosecurity · Feb 16, 2022 · e94570f · e94570f
1 parent 204f9ff
commit e94570f
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp
@@ -150,8 +150,12 @@ static void usage()
 #endif
 	   " -M <num_seconds>              Stop collecting after <num_seconds> reached.\n"
 	   " -N                            When used with --list, only print field names.\n"
-	   " -o, --option <key>=<val>      Set the value of option <key> to <val>. Overrides values in configuration file.\n"
-	   "                               <key> can be a two-part <key>.<subkey>\n"
+	   " -o, --option <opt>=<val>      Set the value of option <opt> to <val>. Overrides values in configuration file.\n"
+	   "                               <opt> can be identified using its location in configuration file using dot notation.\n"
+	   "                               Elements which are entries of lists can be accessed via square brackets [].\n"
+	   "                               E.g. base.id = val\n"
+	   "                                    base.subvalue.subvalue2 = val\n"
+	   "                                    base.list[1]=val\n"
 	   " -p <output_format>, --print <output_format>\n"
 	   "                               Add additional information to each falco notification's output.\n"
 	   "                               With -pc or -pcontainer will use a container-friendly format.\n"