brexhq / substation

Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
https://substation.readme.io
MIT License
322 stars 16 forks source link

feat(transform): Add Multi-Transform Support to Meta Transforms #213

Closed jshlbrd closed 2 months ago

jshlbrd commented 2 months ago

Description

Motivation and Context

This simplifies the project's use of transform functions by making it so that every meta transform function accepts a list of transform functions (instead of only a single transform function). In v2.0 the existing transform support and the MetaPipeline transform will be removed.

For the existing transforms both transform and transforms fields have to be supported simultaneously to not introduce a breaking change, like this:

if len(tf.tfs) > 0 {
    msgs, err = Apply(ctx, tf.tfs, msg)
} else {
    msgs, err = tf.tf.Transform(ctx, msg)
}

Any new meta transform functions should only have a transforms field.

How Has This Been Tested?

Types of changes

Checklist: