feat(alertmanager): fix labels for alertmanager

outputs/alertmanager.go

@@ -20,6 +20,7 @@ package outputs
 import (
 	"encoding/json"
 	"log"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -45,11 +46,13 @@ var defaultSeverityMap = map[types.PriorityType]string{
 	types.Emergency:     "critical",
 }
 
+// labels should match [a-zA-Z_][a-zA-Z0-9_]*
+var reg = regexp.MustCompile("[^a-zA-Z0-9_]")
+
 func newAlertmanagerPayload(falcopayload types.FalcoPayload, config *types.Configuration) []alertmanagerPayload {
 	var amPayload alertmanagerPayload
 	amPayload.Labels = make(map[string]string)
 	amPayload.Annotations = make(map[string]string)
-	replacer := strings.NewReplacer(".", "_", "[", "_", "]", "")
 
 	for i, j := range falcopayload.OutputFields {
 		if strings.HasPrefix(i, "n_evts") {
@@ -87,12 +90,13 @@ func newAlertmanagerPayload(falcopayload types.FalcoPayload, config *types.Confi
 			}
 			continue
 		}
+		safeLabel := reg.ReplaceAllString(i, "_")
 		switch v := j.(type) {
 		case string:
 			//AlertManger unsupported chars in a label name
-			amPayload.Labels[replacer.Replace(i)] = v
+			amPayload.Labels[safeLabel] = v
 		case json.Number:
-			amPayload.Labels[replacer.Replace(i)] = v.String()
+			amPayload.Labels[safeLabel] = v.String()
 		default:
 			continue
 		}

outputs/alertmanager_test.go

@@ -75,3 +75,27 @@ func TestNewAlertmanagerPayloadDropEvent(t *testing.T) {
 
 	require.Equal(t, o1, o2)
 }
+
+func TestNewAlertmanagerPayloadBadLabels(t *testing.T) {
+	input := `{"hostname":"host","output":"Falco internal: syscall event drop. 815508 system calls dropped in last second.","output_fields":{"ebpf/enabled":"1","n drops/buffer?clone{fork]enter":"0","n_drops_buffer_clone_fork_exit":"0"},"priority":"Debug","rule":"Falco internal: syscall event drop","time":"2023-03-03T03:03:03.000000003Z"}`
+	expectedOutput := `[{"labels":{"ebpf_enabled":"1","eventsource":"","hostname":"host","n_drops_buffer_clone_fork_enter":"0","n_drops_buffer_clone_fork_exit":"0","priority":"Warning","rule":"Falco internal: syscall event drop","severity":"warning","source":"falco"},"annotations":{"description":"Falco internal: syscall event drop. 815508 system calls dropped in last second.","info":"Falco internal: syscall event drop. 815508 system calls dropped in last second.","summary":"Falco internal: syscall event drop"},"endsAt":"0001-01-01T00:00:00Z"}]`
+	var f types.FalcoPayload
+	d := json.NewDecoder(strings.NewReader(input))
+	d.UseNumber()
+	err := d.Decode(&f) //have to decode it the way newFalcoPayload does
+	require.Nil(t, err)
+
+	config := &types.Configuration{
+		Alertmanager: types.AlertmanagerOutputConfig{DropEventDefaultPriority: Critical},
+	}
+	json.Unmarshal([]byte(defaultThresholds), &config.Alertmanager.DropEventThresholdsList)
+
+	s, err := json.Marshal(newAlertmanagerPayload(f, config))
+	require.Nil(t, err)
+
+	var o1, o2 []alertmanagerPayload
+	require.Nil(t, json.Unmarshal([]byte(expectedOutput), &o1))
+	require.Nil(t, json.Unmarshal(s, &o2))
+
+	require.Equal(t, o1, o2)
+}