feat(outputs): add hostname, tags, and custom fields to TimesacleDB o…

…utput

Signed-off-by: alika <[email protected]>

README.md

@@ -1236,14 +1236,36 @@ permissions to access the resources you selected to use, like `SQS`, `Lambda`,
 To use TimescaleDB you should create the Hypertable first, following this example
 
 ```sql
-CREATE TABLE falco_events (
+CREATE TABLE falcosidekick_events (
 	time TIMESTAMPTZ NOT NULL,
 	rule TEXT,
 	priority VARCHAR(20),
 	source VARCHAR(20),
-	output TEXT
+	output TEXT,
+	tags TEXT,
+	hostname TEXT,
 );
-SELECT create_hypertable('falco_events', 'time');
+SELECT create_hypertable('falcosidekick_events', 'time');
+```
+
+To support [`customfields`](#yaml-file) ensure you add the custom field to the Hypertable, for example:
+
+```yaml
+customfields: "custom_field_1:custom-value-1"
+```
+
+```sql
+CREATE TABLE falcosidekick_events (
+	time TIMESTAMPTZ NOT NULL,
+	rule TEXT,
+	priority VARCHAR(20),
+	source VARCHAR(20),
+	output TEXT,
+	tags TEXT,
+	hostname TEXT,
+	custom_field_1 TEXT
+);
+SELECT create_hypertable('falcosidekick_events', 'time');
 ```
 
 The name from the table should match with the `hypertable` output configuration.

outputs/timescaledb.go

@@ -4,12 +4,18 @@ import (
 	"context"
 	"fmt"
 	"log"
+	"strings"
 
 	"github.com/DataDog/datadog-go/statsd"
 	"github.com/falcosecurity/falcosidekick/types"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
+type timescaledbPayload struct {
+	SQL    string `json:"sql"`
+	Values []any  `json:"values"`
+}
+
 func NewTimescaleDBClient(config *types.Configuration, stats *types.Statistics, promStats *types.PromStatistics,
 	statsdClient, dogstatsdClient *statsd.Client) (*Client, error) {
 
@@ -39,14 +45,57 @@ func NewTimescaleDBClient(config *types.Configuration, stats *types.Statistics,
 	}, nil
 }
 
+func newTimescaleDBPayload(falcopayload types.FalcoPayload, config *types.Configuration) timescaledbPayload {
+	vals := make(map[string]any, 7+len(config.Customfields))
+	vals[Time] = falcopayload.Time
+	vals[Rule] = falcopayload.Rule
+	vals[Priority] = falcopayload.Priority.String()
+	vals[Source] = falcopayload.Source
+	vals["output"] = falcopayload.Output
+
+	if len(falcopayload.Tags) != 0 {
+		vals[Tags] = strings.Join(falcopayload.Tags, ",")
+	}
+
+	if falcopayload.Hostname != "" {
+		vals[Hostname] = falcopayload.Hostname
+	}
+
+	for k, v := range config.Customfields {
+		if _, exist := vals[k]; !exist {
+			vals[k] = v
+		}
+	}
+
+	i := 0
+	retVals := make([]any, len(vals))
+	var cols strings.Builder
+	var args strings.Builder
+	for k, v := range vals {
+		cols.WriteString(k)
+		fmt.Fprintf(&args, "$%d", i+1)
+		if i < (len(vals) - 1) {
+			cols.WriteString(",")
+			args.WriteString(",")
+		}
+		retVals[i] = v
+		i++
+	}
+
+	sql := fmt.Sprintf("INSERT INTO %s (%s) VALUES (%s)",
+		config.TimescaleDB.HypertableName,
+		cols.String(),
+		args.String())
+
+	return timescaledbPayload{SQL: sql, Values: retVals}
+}
+
 func (c *Client) TimescaleDBPost(falcopayload types.FalcoPayload) {
 	c.Stats.TimescaleDB.Add(Total, 1)
 
-	hypertable := c.Config.TimescaleDB.HypertableName
-	queryInsertData := fmt.Sprintf("INSERT INTO %s (time, rule, priority, source, output) VALUES ($1, $2, $3, $4, $5)", hypertable)
-
 	var ctx = context.Background()
-	_, err := c.TimescaleDBClient.Exec(ctx, queryInsertData, falcopayload.Time, falcopayload.Rule, falcopayload.Priority.String(), falcopayload.Source, falcopayload.Output)
+	tsdbPayload := newTimescaleDBPayload(falcopayload, c.Config)
+	_, err := c.TimescaleDBClient.Exec(ctx, tsdbPayload.SQL, tsdbPayload.Values...)
 	if err != nil {
 		go c.CountMetric(Outputs, 1, []string{"output:timescaledb", "status:error"})
 		c.Stats.TimescaleDB.Add(Error, 1)

outputs/timescaledb_test.go

@@ -0,0 +1,39 @@
+package outputs
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/falcosecurity/falcosidekick/types"
+)
+
+func TestNewTimescaleDBPayload(t *testing.T) {
+	expectedTime, _ := time.Parse(time.RFC3339, "2001-01-01T01:10:00Z")
+	expectedOutput := timescaledbPayload{
+		SQL: "INSERT INTO test_hypertable (source,output,tags,hostname,custom_field_1,time,rule,priority) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)",
+		Values: []any{
+			"syscalls",
+			"This is a test from falcosidekick",
+			"test,example",
+			"test-host",
+			"test-custom-value-1",
+			expectedTime,
+			"Test rule",
+			"Debug",
+		},
+	}
+
+	var f types.FalcoPayload
+	require.Nil(t, json.Unmarshal([]byte(falcoTestInput), &f))
+	config := &types.Configuration{
+		Customfields: map[string]string{"custom_field_1": "test-custom-value-1"},
+		TimescaleDB: types.TimescaleDBConfig{
+			HypertableName: "test_hypertable",
+		},
+	}
+	output := newTimescaleDBPayload(f, config)
+	require.Equal(t, expectedOutput, output)
+}