brexhq / substation

Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
https://substation.readme.io
MIT License
330 stars 21 forks source link

fix(transform): Update Default KV Store TTL offset to 0 #151

Closed shellcromancer closed 8 months ago

shellcromancer commented 8 months ago

Description

Fixes a bug in the initializer for the enrich_kv_store_set transform. Documentation states that this is an optional parameter, but the initializing function will return an error if it's not set.

Error received:

transform: enrich_kv_store_set: time: invalid duration ""

Motivation and Context

This resolved a bug where the application was inconsistent with the documentation.

How Has This Been Tested?

Validated that the config from the documentation can be loaded by the application, previously this errored during load.

sub.transform.enrich.kv_store.set(
  // The value of `domain` is put into the KV store as the value of `ip`.
  settings={kv_store: sub.kv_store.memory(settings={}), object: {source_key: 'ip', target_key: 'domain'}}
)

Types of changes

Checklist: