Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ecs: add args_count field #64

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ecs: add args_count field #64

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 23 additions & 13 deletions core/exporter/encoders/ecs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -470,23 +470,33 @@ func encodeUser(rec *flatrecord.Record) JSONData {
// encodeProcess creates an ECS process field including the nested parent process.
func encodeProcess(rec *flatrecord.Record) JSONData {
exe := flatrecord.Mapper.MapStr(flatrecord.SF_PROC_EXE)(rec)
args_count := 0
if flatrecord.Mapper.MapStr(flatrecord.SF_PROC_ARGS)(rec) != "" {
args_count = len(strings.Split(flatrecord.Mapper.MapStr(flatrecord.SF_PROC_ARGS)(rec), " "))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This simple splitting strategy may lead to false positives. A more accurate counter should consider quotes, positional and keyword arguments. My suggestion is to use shlex: https://pkg.go.dev/github.com/google/shlex

A perfect solution might not be simple, but we can probably use shlex to handle most cases.

}
process := JSONData{
ECS_PROC_EXE: exe,
ECS_PROC_ARGS: flatrecord.Mapper.MapStr(flatrecord.SF_PROC_ARGS)(rec),
ECS_PROC_CMDLINE: flatrecord.Mapper.MapStr(flatrecord.SF_PROC_CMDLINE)(rec),
ECS_PROC_PID: flatrecord.Mapper.MapInt(flatrecord.SF_PROC_PID)(rec),
ECS_PROC_START: utils.ToIsoTimeStr(flatrecord.Mapper.MapInt(flatrecord.SF_PROC_CREATETS)(rec)),
ECS_PROC_NAME: path.Base(exe),
ECS_PROC_THREAD: JSONData{ECS_PROC_TID: flatrecord.Mapper.MapInt(flatrecord.SF_PROC_TID)(rec)},
ECS_PROC_EXE: exe,
ECS_PROC_ARGS: flatrecord.Mapper.MapStr(flatrecord.SF_PROC_ARGS)(rec),
ECS_PROC_ARGS_COUNT: args_count,
ECS_PROC_CMDLINE: flatrecord.Mapper.MapStr(flatrecord.SF_PROC_CMDLINE)(rec),
ECS_PROC_PID: flatrecord.Mapper.MapInt(flatrecord.SF_PROC_PID)(rec),
ECS_PROC_START: utils.ToIsoTimeStr(flatrecord.Mapper.MapInt(flatrecord.SF_PROC_CREATETS)(rec)),
ECS_PROC_NAME: path.Base(exe),
ECS_PROC_THREAD: JSONData{ECS_PROC_TID: flatrecord.Mapper.MapInt(flatrecord.SF_PROC_TID)(rec)},
}
pexe := flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_EXE)(rec)
pargs_count := 0
if flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_ARGS)(rec) != "" {
pargs_count = len(strings.Split(flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_ARGS)(rec), " "))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same comment applies here. We need a better strategy to parse/split the command options string.

}
parent := JSONData{
ECS_PROC_EXE: pexe,
ECS_PROC_ARGS: flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_ARGS)(rec),
ECS_PROC_CMDLINE: flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_CMDLINE)(rec),
ECS_PROC_PID: flatrecord.Mapper.MapInt(flatrecord.SF_PPROC_PID)(rec),
ECS_PROC_START: utils.ToIsoTimeStr(flatrecord.Mapper.MapInt(flatrecord.SF_PPROC_CREATETS)(rec)),
ECS_PROC_NAME: path.Base(pexe),
ECS_PROC_EXE: pexe,
ECS_PROC_ARGS: flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_ARGS)(rec),
ECS_PROC_ARGS_COUNT: pargs_count,
ECS_PROC_CMDLINE: flatrecord.Mapper.MapStr(flatrecord.SF_PPROC_CMDLINE)(rec),
ECS_PROC_PID: flatrecord.Mapper.MapInt(flatrecord.SF_PPROC_PID)(rec),
ECS_PROC_START: utils.ToIsoTimeStr(flatrecord.Mapper.MapInt(flatrecord.SF_PPROC_CREATETS)(rec)),
ECS_PROC_NAME: path.Base(pexe),
}
process[ECS_PROC_PARENT] = parent
return process
Expand Down
Loading