mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 12:27:10 +00:00
1c04ed7874
the high-level change is that events matching a rule are now send into a lua "on_event" function for handling, rather than doing the handling down in c++. more specifics: before, the lua "load_rule" function registered formatters with associated IDs with the c++ side, which later used this state to reconcile events with formats and print output accordingly. now, no such state is kept on the c++ side. the lua "load_rule" function maintains the id->formatters map, and uses it to print outputs when it receives events. this change simplifies the existing flow and will also make the forthcoming implementation of function outputs far simpler than it would have been in the current setup.
22 lines
396 B
C++
22 lines
396 B
C++
#pragma once
|
|
|
|
#include "sinsp.h"
|
|
#include "lua_parser.h"
|
|
|
|
class sinsp_evt_formatter;
|
|
|
|
class digwatch_formats
|
|
{
|
|
public:
|
|
digwatch_formats(sinsp* inspector, lua_State *ls);
|
|
|
|
// formatter = digwatch.formatter(format_string)
|
|
static int formatter(lua_State *ls);
|
|
|
|
// formatted_string = digwatch.format_event(evt, formatter)
|
|
static int format_event(lua_State *ls);
|
|
|
|
private:
|
|
lua_State* m_ls;
|
|
};
|