Only have -pc/-pk apply to syscall rules (#495)

Currently, -pc/-pk results in extra fields added to the output field of
all rules. They should only be added for syscall rules.
This commit is contained in:
Mark Stemm
2019-01-14 10:00:43 -08:00
committed by GitHub
parent 611877e4d3
commit 5e5742f87d

View File

@@ -493,6 +493,7 @@ function load_rules(sinsp_lua_parser,
-- If the format string contains %container.info, replace it
-- with extra. Otherwise, add extra onto the end of the format
-- string.
if v['source'] == "syscall" then
if string.find(v['output'], "%container.info", nil, true) ~= nil then
-- There may not be any extra, or we're not supposed
@@ -513,6 +514,7 @@ function load_rules(sinsp_lua_parser,
v['output'] = v['output'].." "..extra
end
end
end
-- Ensure that the output field is properly formatted by
-- creating a formatter from it. Any error will be thrown