Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support additional PD-CEF fields and optionally send templated details as Struct/JSON #44

Open
atomicules opened this issue Nov 10, 2021 · 0 comments

Comments

@atomicules
Copy link

This is a single issue, but contains two parts:

  1. A request to add support for the remaining PD-CEF fields of:
    1. Timestamp
    2. Class
    3. Group
  2. A request to support processing the details template as json so we can send structured data through to Pagerduty. At the moment the options are:
    1. Send through the full event JSON. This is a lot of unnecessary data and the deep nesting of fields (when using labels and annotations) makes it hard to read some fields on Pagerduty
    2. Use a template to select required fields. Which unfortunately sends through the data as a string with no structure on the Pagerduty side which means you can't really use custom details in event rules

I'm hoping 1 is pretty uncontroversial and can be done. I would prefer it if these work similarly to summary and use a template.

I could accept 2 not happening if 1 goes ahead, but it really would be nice to have the option of templating structured data one-way or another.

In accordance with the contributing guidelines I'm opening an issue to discuss first, but I have made initial code changes on this branch. The changes can be seen on this compare view

I have tried to separate the commits to cover both requests:

  • These two commits for adding the additional PD-CEF fields.
  • This commit which adds a --send-details-as-json flag to process the template as json.

There is undoubtably a better way of doing 2 than what I've done - and I definitely welcome feedback and guidance. What I've done is pretty simplistic: When I realised that using the template returned a string I just used a json.Unmarshal to parse that string as a Struct/JSON. It "works", but maybe a real solution lies deeper in the templating stuff?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant