Merge pull request #19 from Issif/v1.0.6

Change `SLACK_HIDE_FIELDS` for `SLACK_OUTPUT_FORMAT`
falcosecurity · May 9, 2019 · 92ec43b · 92ec43b
2 parents aff03bd + bcd003f
commit 92ec43b
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.0.7 - 2019-05-09
+
+#### Enhancement
+- Change `SLACK_HIDE_FIELDS` for `SLACK_OUTPUT_FORMAT`, you can now choose how events are displayed in Slack
+
 ## 1.0.6 - 2019-05-09
 #### New
 - Add `SLACK_HIDE_FIELDS` env var, to enable concise output in Slack (fields are not displayed) ([issue #15](https://github.com/Issif/falcosidekick/issues/15))

diff --git a/README.md b/README.md
@@ -41,7 +41,7 @@ Configuration of the daemon is made by Env vars :
 * **SLACK_TOKEN** : Slack URL + token (ex: https://hooks.slack.com/services/XXXX/YYYY/ZZZZ), if not `empty`, Slack output is *enabled*
 * **SLACK_FOOTER** : Slack footer
 * **SLACK_ICON** : Slack icon (avatar)
-* **SLACK_HIDE_FIELDS** : if `true`, detailed fields will not be displayed
+* **SLACK_OUTPUT_FORMAT** : `all` (default), `text` (only text is displayed in Slack), `fields` (only fields are displayed in Slack)
 * **DATADOG_TOKEN** : Datadog token, if not `empty`, Datadog output is *enabled*
 * **ALERTMANAGER_HOST_PORT** : AlertManager host:port, if not `empty`, AlertManager is *enabled*
 * **DEBUG** : if *true* all outputs will print in stdout the payload they send

diff --git a/outputs/slack.go b/outputs/slack.go
@@ -40,7 +40,7 @@ func newSlackPayload(falcopayload types.FalcoPayload) slackPayload {
 	var fields []slackAttachmentField
 	var field slackAttachmentField
 
-	if os.Getenv("SLACK_HIDE_FIELDS") != "true" {
+	if os.Getenv("SLACK_OUTPUT_FORMAT") == "all" || os.Getenv("SLACK_OUTPUT_FORMAT") == "fields" || os.Getenv("SLACK_OUTPUT_FORMAT") == "" {
 		for i, j := range falcopayload.OutputFields {
 			switch j.(type) {
 			case string:
@@ -77,7 +77,9 @@ func newSlackPayload(falcopayload types.FalcoPayload) slackPayload {
 
 	attachment.Fallback = falcopayload.Output
 	attachment.Fields = fields
-	attachment.Text = falcopayload.Output
+	if os.Getenv("SLACK_OUTPUT_FORMAT") == "all" || os.Getenv("SLACK_OUTPUT_FORMAT") == "text" || os.Getenv("SLACK_OUTPUT_FORMAT") == "" {
+		attachment.Text = falcopayload.Output
+	}
 
 	var color string
 	switch falcopayload.Priority {