CrowdStrike / falcon-integration-gateway

Falcon Integration Gateway (FIG)
The Unlicense
18 stars 17 forks source link

feat: add ability to pass in stream offset #168

Closed carlosmmatos closed 11 months ago

carlosmmatos commented 11 months ago

Don't know why, but the ability to pass in the offset was not something viable. This PR introduces the ability to start your stream from an offset via the configuration settings.

  1. You can either pass it in via the config.ini file [events]::offset
  2. Alternatively, you can pass it in via the EVENTS_OFFSET environment variable.

⚠️ This will only be useful for event streams that only have 1 feed. For multi-feed event streams, it's best to handle it externally, or submit an issue requesting for this support to be added to a backend.