feat(outputs): add hostname, tags, custom, and templated fields to TimescaleDB

[alika]

What type of PR is this?
/kind feature

Any specific area of the project related to this PR?
/area outputs

What this PR does / why we need it:
This PR adds support for hostname, tags, custom fields, and templated fields for the TimescaleDB output.

Which issue(s) this PR fixes:

Fixes #

[Issif]

I see the output fields are not added, because of the the schema. Do you think it worth to add k8s.pod.name and k8s.ns.name at least? IN prometheus for example, to avoid huge cardinality, we add these fields as labels and the custom fields.

[alika]

I see the output fields are not added, because of the the schema. Do you think it worth to add k8s.pod.name and k8s.ns.name at least? IN prometheus for example, to avoid huge cardinality, we add these fields as labels and the custom fields.

Sure, sounds reasonable. I'll add support for output fields.

[Issif]

I see the output fields are not added, because of the the schema. Do you think it worth to add k8s.pod.name and k8s.ns.name at least? IN prometheus for example, to avoid huge cardinality, we add these fields as labels and the custom fields.

Sure, sounds reasonable. I'll add support for output fields.

All output fields it will be hard, because they are dynamic, but at least the custom fields added statically by Falcosidekick BUT it means you need to deal with the addition of new fields after the creation of the index, ie, a schema update.

Tell me when it's ready, I'll review this PR at this moment. Thanks.

[alika]

I see the output fields are not added, because of the the schema. Do you think it worth to add k8s.pod.name and k8s.ns.name at least? IN prometheus for example, to avoid huge cardinality, we add these fields as labels and the custom fields.

Sure, sounds reasonable. I'll add support for output fields.

All output fields it will be hard, because they are dynamic, but at least the custom fields added statically by Falcosidekick BUT it means you need to deal with the addition of new fields after the creation of the index, ie, a schema update.

Tell me when it's ready, I'll review this PR at this moment. Thanks.

After I looked at how newFalcoPayload works I understand how OutputFields is already populated w/Customfields and Templatedfields. I have an implementation right now that only adds to TimescaleDB payload if it is declared in either Customefields or Templatedfields. Just doing a bit more actual testing and I'll have this PR updated soon (<24h).

[alika]

@Issif ready for review now. I had to touch config because I was getting a panic on templated fields:

panic: assignment to entry in nil map

goroutine 1 [running]:
main.getConfig()
        /Users/alika/projects/ref/falcosidekick/config.go:474 +0x3eeb
main.init.0()
        /Users/alika/projects/ref/falcosidekick/main.go:89 +0xff

[Issif]

Sorry for the delay, I was successively sick, off and at kubecon in last weeks. Have you fixed the issue with the nil map? Can I review the whole PR now? Thanks

[alika]

Sorry for the delay, I was successively sick, off and at kubecon in last weeks. Have you fixed the issue with the nil map? Can I review the whole PR now? Thanks

No worries. Hope kubecon was fun. I did fix this issue w/the nil map and I'm ready for a review.

[poiana]

LGTM label has been added.

Git tree hash: a3aac9de46e6817dc30db3c9e2b7d2150577bb20

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alika, Issif

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Issif]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment