-
Notifications
You must be signed in to change notification settings - Fork 353
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Updated GC log parser to include status fields #4918
base: main
Are you sure you want to change the base?
Conversation
Thanks for the proposed changes, @sydp would you like to take a first look at these changes? |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4918 +/- ##
==========================================
- Coverage 85.05% 85.04% -0.02%
==========================================
Files 431 431
Lines 38645 38657 +12
==========================================
+ Hits 32870 32874 +4
- Misses 5775 5783 +8 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is it possible to update the corresponding test data and unit tests to include these new changes?
Updated but test seem to be timing out today |
@@ -35,6 +35,8 @@ class GCPLogEventData(events.EventData): | |||
resource_name (str): name of the resource. | |||
service_account_display_name (str): display name of the service account. | |||
service_name (str): name of the servie. | |||
status_message (str): the status message of the request. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
missed this in the first pass, lets keep these in alphabetical order too
One line description of pull request
Added parsing for protoPayload.status.message and protoPayload.status.details[0].reason to the Google Cloud log parser
Description:
This adds parsing for additional data from Google Cloud logs. Specifically the
protoPayload.status
. This now parses thestatus.message
andstatus.details[0].reason
fields into status_message and status_reason respectively.This has been tested using dftimewolf to download the data and pass it to a custom container and tested locally.
Related issue (if applicable): fixes #
Fixing issue #4917
Notes:
All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.
One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.
Checklist: