From 21bf6f8093b30529247c39472dbe0d3c5edbbef7 Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Mon, 24 Oct 2016 15:55:02 -0700 Subject: [PATCH] Updated Falco Formatting for Containers and Orchestration (markdown) --- Falco-Formatting-for-Containers-and-Orchestration.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Falco-Formatting-for-Containers-and-Orchestration.md b/Falco-Formatting-for-Containers-and-Orchestration.md index a4f0d1a..4a70525 100644 --- a/Falco-Formatting-for-Containers-and-Orchestration.md +++ b/Falco-Formatting-for-Containers-and-Orchestration.md @@ -4,11 +4,11 @@ Like sysdig, falco can be run with `-pk`/`-pm`/`-pc`/`-p` arguments that change The information from k8s/mesos/containers is used in conjunction with the command line options in these ways: -* In rule outputs, if the format string contains %container.info, that is replaced with the value from -pk/-pm/-pc, if one of those options was provided. If no option was provided, %container.info is replaced with a generic %container.name (id=%container.id) instead. +* In rule outputs, if the format string contains `%container.info`, that is replaced with the value from `-pk`/`-pm`/`-pc`, if one of those options was provided. If no option was provided, `%container.info` is replaced with a generic `%container.name (id=%container.id)` instead. -* If the format string does not contain %container.info, and one of -pk/-pm/-pc was provided, that is added to the end of the formatting string. +* If the format string does not contain `%container.info`, and one of `-pk`/`-pm`/`-pc` was provided, that is added to the end of the formatting string. -* If -p was specified with a general value (i.e. not -pk/-pm/-pc), the value is simply added to the end and any %container.info is replaced with the generic value. +* If `-p` was specified with a general value (i.e. not `-pk`/`-pm`/`-pc`), the value is simply added to the end and any `%container.info` is replaced with the generic value. ## Examples