ecs: add args_count field #64
Conversation
Signed-off-by: Anikeev Vladimir <[email protected]>
|
@araujof, is there a chance that this request will be merged? |
|
Hi @Vladimir-A -- sorry for my delayed response. I was on leave and just catching up on things. I will review the PR. Thanks for your contribution! |
There was a problem hiding this comment.
I suggest you refactor the code to use the shlex package to split the command options into tokens that can then be used to count the command line arguments. Once the initial split is done, we can use some simple heuristics to parse the slice into groups of keyword and positional arguments, and then get a final count on those groups. We should create a helper function for this.
@terylpt any additional thoughts?
| @@ -470,23 +470,33 @@ func encodeUser(rec *flatrecord.Record) JSONData { | |||
| // encodeProcess creates an ECS process field including the nested parent process. | |||
| func encodeProcess(rec *flatrecord.Record) JSONData { | |||
| exe := flatrecord.Mapper.MapStr(flatrecord.SF_PROC_EXE)(rec) | |||
| args_count := 0 | |||
| if flatrecord.Mapper.MapStr(flatrecord.SF_PROC_ARGS)(rec) != "" { | |||
| args_count = len(strings.Split(flatrecord.Mapper.MapStr(flatrecord.SF_PROC_ARGS)(rec), " ")) | |||
There was a problem hiding this comment.
This simple splitting strategy may lead to false positives. A more accurate counter should consider quotes, positional and keyword arguments. My suggestion is to use shlex: https://pkg.go.dev/github.com/google/shlex
A perfect solution might not be simple, but we can probably use shlex to handle most cases.
| } | ||
| pexe := flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_EXE)(rec) | ||
| pargs_count := 0 | ||
| if flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_ARGS)(rec) != "" { | ||
| pargs_count = len(strings.Split(flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_ARGS)(rec), " ")) |
There was a problem hiding this comment.
The same comment applies here. We need a better strategy to parse/split the command options string.
Added implementation of the args_count field for process and pprocess.
ecs_mapping