Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adding filter processor in receiver and collector #10

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

Shashankft9
Copy link
Contributor

fixes #8

Signed-off-by: Shashankft9 <shanky.337marchss@gmail.com>
error_mode: ignore
logs:
log_record:
- 'not (IsMatch(body, ".*Permission denied.*"))'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Shashankft9 Thank you for the PR! 🚀
Though this method to filter logs will work however it shouldn't be handled this way ideally. It's because there is logic for filtering already present in Kubearmor.

Kubearmor emits separate streams for logs (generic events) and alerts (policy events). So a good place to investigate will be why the adapter can't subscribe to just a single stream based on the configuration passed.
The relevant code -

if logfilter == "all" || logfilter == "policy" {

@DelusionalOptimist
Copy link
Member

cc @Chinwendu20

@Chinwendu20
Copy link
Contributor

Hello thanks for the PR but the receiver has a config for getting the required kubearmor logs. We will fix anything wrong in the code instead of adding extra components to the collector distro.

@DelusionalOptimist
Copy link
Member

@Shashankft9 PTAL at the changes introduced by PR: #11
You can set the configuration in the receiver's manifest according to this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

kubearmor receiver unable to filter logs before sending to loki
3 participants