falcosecurity / falcosidekick

Connect Falco to your ecosystem

Apache License 2.0

551 stars 181 forks source link

fix missing extra fields when the key doesn't contain a dot and flatt… #1034

Closed Issif closed 3 weeks ago

Issif commented 3 weeks ago

…enfields=true

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

Any specific area of the project related to this PR?

/area outputs

What this PR does / why we need it:

If elasticsearch.flattenfields == true, because of a missing check, the output_fields with a key without dot are deleted.

Which issue(s) this PR fixes:

1033

Fixes #

Special notes for your reviewer:

poiana commented 3 weeks ago

LGTM label has been added.

Git tree hash: 1717ed395f2e9b9198026227cbfe5609c2d42c5d

poiana commented 3 weeks ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Issif, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/falcosidekick/blob/master/OWNERS)~~ [Issif,leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment