Skip to content

feat(engine): add JSON as output format for --list/--list_events#3803

Open
legobrick wants to merge 3 commits intofalcosecurity:masterfrom
legobrick:json_fields_events_output
Open

feat(engine): add JSON as output format for --list/--list_events#3803
legobrick wants to merge 3 commits intofalcosecurity:masterfrom
legobrick:json_fields_events_output

Conversation

@legobrick
Copy link
Contributor

@legobrick legobrick commented Feb 14, 2026

  • Added support of the JSON format
  • Refactored field and events formatting using the strategy pattern

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it: Implements support for printing fields and events in JSON. This allows processing and storing them to build a more consolidated repository of those, to fuel side-artifacts like documentation, autocompletion and others, being able to support also plugins and being able to better address versioning, by storing a field definition per-version and computing a multi-version field table.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer: follows the work in falcosecurity/libs#2837

Does this PR introduce a user-facing change?: YES

feat(engine): --markdown has been deprecated in favor of --format, adding the support of json as alternative to markdown and string

@poiana
Copy link
Contributor

poiana commented Feb 14, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: legobrick
Once this PR has been reviewed and has the lgtm label, please assign ekoops for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions
Copy link

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

@legobrick legobrick marked this pull request as ready for review February 19, 2026 11:00
@legobrick legobrick force-pushed the json_fields_events_output branch from 2de6a93 to 2a80a17 Compare February 19, 2026 11:01
Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @legobrick

Thanks for this effort!

First of all, to address the failing CI checks, we need to bump libs. We are doing this on #3799. Let's wait for it, and then rebase, please.

Also, I just found minor issues. Otherwise, SGTM. See my suggestions below.

Finally, the clang-format check is failing on the new code (alignment in field_formatter.h, line wrapping in falco_engine.h, and options.cpp). Please fix it or use the pre-commit hook.

legobrick and others added 2 commits March 13, 2026 22:38
- Added support of the JSON format
- Refactored field and events formatting using the strategy pattern

Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
Signed-off-by: Paolo Polidori <polyp91@gmail.com>

Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
@legobrick legobrick force-pushed the json_fields_events_output branch 3 times, most recently from bbfc65e to 38468e7 Compare March 13, 2026 21:52
- Move output_format.h from userspace/falco/ to userspace/engine/ to
  fix reverse dependency (engine layer was including from app layer);
  update all include paths accordingly
- Add SPDX-License-Identifier to output_format.h
- Remove leftover m_first_event_in_category field from MarkdownFormatter
  (was set in begin_category() but never read)
- Emit deprecation warning to stderr when --markdown is used

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
@legobrick legobrick force-pushed the json_fields_events_output branch from 38468e7 to 7bae6be Compare March 13, 2026 21:54
@legobrick
Copy link
Contributor Author

Hey @legobrick

Thanks for this effort!

First of all, to address the failing CI checks, we need to bump libs. We are doing this on #3799. Let's wait for it, and then rebase, please.

Also, I just found minor issues. Otherwise, SGTM. See my suggestions below.

Finally, the clang-format check is failing on the new code (alignment in field_formatter.h, line wrapping in falco_engine.h, and options.cpp). Please fix it or use the pre-commit hook.

Thanks for the review @leogr, comments should be all addressed and the PR has been rebased

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

3 participants