Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't produce duplicate entries when events have non-string fields #38

Merged
merged 1 commit into from
Oct 4, 2019

Conversation

actgardner
Copy link
Contributor

Falco emits events that include non-string fields (like proc.tty). When some outputs encountered these fields, they would re-append the previous string field because the variable was reused. This resulted in duplicated fields in the output. This PR drops the numeric fields for now and fixes the duplicated fields.

@Issif Issif self-assigned this Oct 3, 2019
@Issif Issif added the kind/bug Something isn't working label Oct 3, 2019
@Issif
Copy link
Member

Issif commented Oct 3, 2019

Hi,

I never noticed that behavior but you're right.

I tried this

curl "http://localhost:2801/" -d'{"output":"This is a test from falcosidekick","priority":"Debug","rule":"Test rule", "time":"2001-01-01T01:10:00Z","output_fields": {"proc.name":"falcosidekick","user.name":"falcosidekick", "proc.tty": 1234}}' 

And I got duplicate entries :

image

I discover the continue statement, I only knew break.

I'm preparing a new release, I will merge your PR and rebase on right after.

Thanks.

@Issif Issif merged commit a7f48a7 into falcosecurity:master Oct 4, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants