feat(engine): add JSON as output format for --list/--list_events#3803
feat(engine): add JSON as output format for --list/--list_events#3803legobrick wants to merge 3 commits intofalcosecurity:masterfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: legobrick The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped. Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION. /hold |
2de6a93 to
2a80a17
Compare
leogr
left a comment
There was a problem hiding this comment.
Hey @legobrick
Thanks for this effort!
First of all, to address the failing CI checks, we need to bump libs. We are doing this on #3799. Let's wait for it, and then rebase, please.
Also, I just found minor issues. Otherwise, SGTM. See my suggestions below.
Finally, the clang-format check is failing on the new code (alignment in field_formatter.h, line wrapping in falco_engine.h, and options.cpp). Please fix it or use the pre-commit hook.
- Added support of the JSON format - Refactored field and events formatting using the strategy pattern Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
Signed-off-by: Paolo Polidori <polyp91@gmail.com> Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
bbfc65e to
38468e7
Compare
- Move output_format.h from userspace/falco/ to userspace/engine/ to fix reverse dependency (engine layer was including from app layer); update all include paths accordingly - Add SPDX-License-Identifier to output_format.h - Remove leftover m_first_event_in_category field from MarkdownFormatter (was set in begin_category() but never read) - Emit deprecation warning to stderr when --markdown is used Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
38468e7 to
7bae6be
Compare
Thanks for the review @leogr, comments should be all addressed and the PR has been rebased |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area engine
What this PR does / why we need it: Implements support for printing fields and events in JSON. This allows processing and storing them to build a more consolidated repository of those, to fuel side-artifacts like documentation, autocompletion and others, being able to support also plugins and being able to better address versioning, by storing a field definition per-version and computing a multi-version field table.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer: follows the work in falcosecurity/libs#2837
Does this PR introduce a user-facing change?: YES