github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-03 15:46:33 +00:00
Code Issues Projects Releases Wiki Activity

Add base64 encoding and snap length support (#410)

Browse Source 
sysdig-CLA-1.0-signed-off-by: Yue Feng <ztz5651483@gmail.com>
falco-CLA-1.0-signed-off-by: Yue Feng <ztz5651483@gmail.com>
This commit is contained in:
ztz
2018-09-26 03:44:09 +08:00
committed by Mark Stemm
parent fc70c635d1
commit 6b82ecfa79
2 changed files with 46 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
userspace/engine/formats.cpp
View File

@@ -116,7 +116,27 @@ int falco_formats::format_event (lua_State *ls)
if(s_json_output)
{
s_inspector->set_buffer_format(sinsp_evt::PF_JSON);
switch(s_inspector->get_buffer_format())
{
case sinsp_evt::PF_NORMAL:
s_inspector->set_buffer_format(sinsp_evt::PF_JSON);
break;
case sinsp_evt::PF_EOLS:
s_inspector->set_buffer_format(sinsp_evt::PF_JSONEOLS);
break;
case sinsp_evt::PF_HEX:
s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEX);
break;
case sinsp_evt::PF_HEXASCII:
s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEXASCII);
break;
case sinsp_evt::PF_BASE64:
s_inspector->set_buffer_format(sinsp_evt::PF_JSONBASE64);
break;
default:
// do nothing
break;
}
s_formatters->tostring(evt, sformat, &json_line);
// The formatted string might have a leading newline. If it does, remove it.
@@ -124,8 +144,6 @@ int falco_formats::format_event (lua_State *ls)
{
json_line.erase(0, 1);
}
s_inspector->set_buffer_format(sinsp_evt::PF_NORMAL);
}
}
catch (sinsp_exception& e)