Skip to content

Commit

Permalink
Changed format of the 'output' field in the JSON payload
Browse files Browse the repository at this point in the history
Signed-off-by: h4l0gen <[email protected]>

updated

Signed-off-by: h4l0gen <[email protected]>

build error fixed

Signed-off-by: h4l0gen <[email protected]>
  • Loading branch information
h4l0gen authored and Andreagit97 committed Mar 21, 2024
1 parent 2dfac14 commit bbdb368
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions userspace/engine/formats.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,6 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,

formatter = m_falco_engine->create_formatter(source, format);

// Format the original output string, regardless of output format
formatter->tostring_withformat(evt, line, sinsp_evt_formatter::OF_NORMAL);

if(formatter->get_output_format() == sinsp_evt_formatter::OF_JSON)
{
std::string json_line;
Expand Down Expand Up @@ -89,6 +86,7 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,
if(m_json_include_output_property)
{
// This is the filled-in output line.
formatter->tostring_withformat(evt, line, sinsp_evt_formatter::OF_JSON);
event["output"] = line;
}

Expand Down Expand Up @@ -127,6 +125,10 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,
full_line.append("}");
line = full_line;
}
else
{
formatter->tostring_withformat(evt, line, sinsp_evt_formatter::OF_NORMAL);
}

return line;
}
Expand Down

0 comments on commit bbdb368

Please sign in to comment.