Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated GC log parser to include status fields #4918

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

tmoney-coder
Copy link

One line description of pull request

Added parsing for protoPayload.status.message and protoPayload.status.details[0].reason to the Google Cloud log parser

Description:

This adds parsing for additional data from Google Cloud logs. Specifically the protoPayload.status. This now parses the status.message and status.details[0].reason fields into status_message and status_reason respectively.

This has been tested using dftimewolf to download the data and pass it to a custom container and tested locally.

Related issue (if applicable): fixes #
Fixing issue #4917

Notes:

All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.

One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.

Checklist:

  • Automated checks (GitHub Actions, AppVeyor) pass
  • No new new dependencies are required or l2tdevtools has been updated
  • Reviewer assigned

@joachimmetz
Copy link
Member

Thanks for the proposed changes, @sydp would you like to take a first look at these changes?

Copy link

codecov bot commented Oct 17, 2024

Codecov Report

Attention: Patch coverage is 33.33333% with 8 lines in your changes missing coverage. Please review.

Project coverage is 85.04%. Comparing base (4a3ce9d) to head (4217444).

Files with missing lines Patch % Lines
plaso/parsers/jsonl_plugins/gcp_log.py 33.33% 8 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4918      +/-   ##
==========================================
- Coverage   85.05%   85.04%   -0.02%     
==========================================
  Files         431      431              
  Lines       38645    38657      +12     
==========================================
+ Hits        32870    32874       +4     
- Misses       5775     5783       +8     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@sydp sydp self-assigned this Oct 18, 2024
Copy link
Contributor

@sydp sydp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible to update the corresponding test data and unit tests to include these new changes?

plaso/parsers/jsonl_plugins/gcp_log.py Outdated Show resolved Hide resolved
plaso/parsers/jsonl_plugins/gcp_log.py Outdated Show resolved Hide resolved
plaso/parsers/jsonl_plugins/gcp_log.py Outdated Show resolved Hide resolved
@tmoney-coder
Copy link
Author

Updated but test seem to be timing out today

@@ -35,6 +35,8 @@ class GCPLogEventData(events.EventData):
resource_name (str): name of the resource.
service_account_display_name (str): display name of the service account.
service_name (str): name of the servie.
status_message (str): the status message of the request.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missed this in the first pass, lets keep these in alphabetical order too

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants