diff --git a/userspace/engine/lua/rule_loader.lua b/userspace/engine/lua/rule_loader.lua index 725c31ac..4e18ede8 100644 --- a/userspace/engine/lua/rule_loader.lua +++ b/userspace/engine/lua/rule_loader.lua @@ -436,7 +436,10 @@ function on_event(evt_, rule_id) rule_output_counts.by_name[rule.rule] = rule_output_counts.by_name[rule.rule] + 1 end - return rule.rule, rule.priority, rule.output + -- Prefix output with '*' so formatting is permissive + output = "*"..rule.output + + return rule.rule, rule.priority, output end function print_stats() diff --git a/userspace/falco/lua/output.lua b/userspace/falco/lua/output.lua index 39a321c8..5a50f9de 100644 --- a/userspace/falco/lua/output.lua +++ b/userspace/falco/lua/output.lua @@ -76,6 +76,13 @@ end function output_event(event, rule, priority, format) local level = level_of(priority) + + -- If format starts with a *, remove it, as we're adding our own + -- prefix here. + if format:sub(1,1) == "*" then + format = format:sub(2) + end + format = "*%evt.time: "..levels[level+1].." "..format if formatters[rule] == nil then formatter = formats.formatter(format)