Skip to content

Conversation

@Shashankft9
Copy link
Contributor

fixes #8

error_mode: ignore
logs:
log_record:
- 'not (IsMatch(body, ".*Permission denied.*"))'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Shashankft9 Thank you for the PR! 🚀
Though this method to filter logs will work however it shouldn't be handled this way ideally. It's because there is logic for filtering already present in Kubearmor.

Kubearmor emits separate streams for logs (generic events) and alerts (policy events). So a good place to investigate will be why the adapter can't subscribe to just a single stream based on the configuration passed.
The relevant code -

if logfilter == "all" || logfilter == "policy" {

@DelusionalOptimist
Copy link
Member

cc @Chinwendu20

@Chinwendu20
Copy link
Contributor

Hello thanks for the PR but the receiver has a config for getting the required kubearmor logs. We will fix anything wrong in the code instead of adding extra components to the collector distro.

@DelusionalOptimist
Copy link
Member

@Shashankft9 PTAL at the changes introduced by PR: #11
You can set the configuration in the receiver's manifest according to this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

kubearmor receiver unable to filter logs before sending to loki

3 participants