diff --git a/proposals/20210501-plugin-system.md b/proposals/20210501-plugin-system.md index 58a12f67..b8c35b40 100644 --- a/proposals/20210501-plugin-system.md +++ b/proposals/20210501-plugin-system.md @@ -66,7 +66,7 @@ Source plugins also provide an "id", which is globally unique and is used in cap An extractor plugin focuses only on field extraction from events generated by other plugins, or by the core libraries. It does *not* provide an event source, but can extract fields from other event sources. An example is json field extraction, where a plugin might be able to extract fields from arbitrary json payloads. -An extractor plugin provides an optional set of event sources. When the framework receives an event with an event source in the plugin's set of event sources, fields in expressions/Falco outputs will be extracted from events using the plugin. An extractor plugin can also *not* name a set of event sources. In this case, fields will be extracted from *all* events, regardless of source. In this case, the exctractor plugin must detect the format of arbitrary payloads and be able to return NULL/no value when the payload is not supported. +An extractor plugin provides an optional set of event sources. When the framework receives an event with an event source in the plugin's set of event sources, fields in expressions/Falco outputs will be extracted from events using the plugin. An extractor plugin can also *not* name a set of event sources. In this case, fields will be extracted from *all* events, regardless of source. In this case, the extractor plugin must detect the format of arbitrary payloads and be able to return NULL/no value when the payload is not supported. ### Support for Plugin Events in Capture Files. @@ -474,7 +474,7 @@ typedef struct // Return value: a json array of strings containing event // sources returned by a source plugin's get_event_source() // function. - // This function is optional--if NULL then the exctractor + // This function is optional--if NULL then the extractor // plugin will receive every event. // char* (*get_extract_event_sources)();