Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide an option to omit "output" field in JSON output events. #340

Closed
alukyan opened this issue Mar 26, 2018 · 0 comments · Fixed by #342
Closed

Provide an option to omit "output" field in JSON output events. #340

alukyan opened this issue Mar 26, 2018 · 0 comments · Fixed by #342

Comments

@alukyan
Copy link

alukyan commented Mar 26, 2018

When Falco uses JSON format for output events the information in "output" and "output_fields" is duplicated. When Falco events are automatically processed by another system it is often not necessary to have human readable "output" part of the event, which almost doubles the size of the message leading to extra overhead in sending, processing and storing events externally. It is always possible to parse the message and remove unwanted part, but providing simple option to omit human readable part of the event right during event generation seems to be simplest solution.

{"output":"16:59:59.652105834: Informational user=root pid=93384 process=sh 
cmdline=sh -c iptables --version ppid=1813 parent=python3 
pcmdline=python3 -u bin/WALinuxAgent-2.2.21-py2.7.egg -run-exthandlers gparent=python3 ggparent=systemd gggparent=<NA> ggggparent=<NA>",
"priority":"Informational","rule":"New process started", "time":"2018-03-26T16:59:59.652105834Z",
"output_fields": {"evt.time":1522083599652105834,"proc.aname":null,"proc.cmdline":"sh -c iptables --version",
"proc.name":"sh","proc.pcmdline":"python3 -u bin/WALinuxAgent-2.2.21-py2.7.egg -run-exthandlers",
"proc.pid":93384,"proc.pname":"python3","proc.ppid":1813,"user.name":"root"}}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant