...

main.go

@@ -96,7 +96,7 @@ var (
 	config                        *types.Configuration
 	stats                         *types.Statistics
 	promStats                     *types.PromStatistics
-	initParams                    *types.InitParams
+	initClientArgs                *types.InitClientArgs
 
 	regPromLabels *regexp.Regexp
 )
@@ -125,7 +125,7 @@ func init() {
 		DogstatsdClient: dogstatsdClient,
 	}
 
-	initParams = &types.InitParams{
+	initClientArgs = &types.InitClientArgs{
 		Config:          config,
 		Stats:           stats,
 		DogstatsdClient: dogstatsdClient,
@@ -262,7 +262,7 @@ func init() {
 		endpointUrl := fmt.Sprintf("%s/%s/%s/ingest", config.Quickwit.HostPort, config.Quickwit.ApiEndpoint, config.Quickwit.Index)
 		quickwitClient, err = outputs.NewClient("Quickwit", endpointUrl, config.Quickwit.MutualTLS, config.Quickwit.CheckCert, config, stats, promStats, statsdClient, dogstatsdClient)
 		if err == nil {
-			err = quickwitClient.AutoCreateQuickwitIndex(*initParams)
+			err = quickwitClient.AutoCreateQuickwitIndex(*initClientArgs)
 		}
 
 		if err != nil {

outputs/client.go

@@ -144,7 +144,7 @@ type Client struct {
 }
 
 // InitClient returns a new output.Client for accessing the different API.
-func InitClient(outputType string, defaultEndpointURL string, mutualTLSEnabled bool, checkCert bool, params types.InitParams) (*Client, error) {
+func InitClient(outputType string, defaultEndpointURL string, mutualTLSEnabled bool, checkCert bool, params types.InitClientArgs) (*Client, error) {
 	return NewClient(outputType, defaultEndpointURL, mutualTLSEnabled, checkCert, params.Config, params.Stats, params.PromStats, params.StatsdClient, params.DogstatsdClient)
 }
 

outputs/quickwit.go

@@ -49,7 +49,7 @@ type QuickwitDocMapping struct {
 	FieldMappings  []QuickwitFieldMapping `json:"field_mappings"`
 	Mode           string                 `json:"mode"`
 	StoreSource    bool                   `json:"store_source"`
-	TimestampField bool                   `json:"timestamp_field"`
+	TimestampField string                 `json:"timestamp_field"`
 }
 
 type QuickwitMappingPayload struct {
@@ -59,7 +59,7 @@ type QuickwitMappingPayload struct {
 	DocMapping     QuickwitDocMapping     `json:"doc_mapping"`
 }
 
-func (c *Client) AutoCreateQuickwitIndex(params types.InitParams) error {
+func (c *Client) AutoCreateQuickwitIndex(params types.InitClientArgs) error {
 	config := params.Config.Quickwit
 	if config.AutoCreateIndex {
 		endpointUrl := fmt.Sprintf("%s/%s/indexes", config.HostPort, config.ApiEndpoint)
@@ -72,7 +72,9 @@ func (c *Client) AutoCreateQuickwitIndex(params types.InitParams) error {
 			Id:      config.Index,
 			Version: config.IndexVersion,
 			DocMapping: QuickwitDocMapping{
-				Mode: "dynamic",
+				Mode:           "dynamic",
+				StoreSource:    true,
+				TimestampField: "time",
 				DynamicMapping: QuickwitDynamicMapping{
 					Description: "Falco",
 					Fast:        true,
@@ -88,15 +90,30 @@ func (c *Client) AutoCreateQuickwitIndex(params types.InitParams) error {
 						Type: "datetime",
 						Fast: true,
 					},
+					{
+						Name: "priority",
+						Type: "i64",
+						Fast: true,
+					},
 					{
 						Name: "source",
 						Type: "text",
 						Fast: true,
 					},
+					{
+						Name: "output",
+						Type: "string",
+						Fast: true,
+					},
+					{
+						Name: "rule",
+						Type: "string",
+						Fast: true,
+					},
 				},
 			},
 			SearchSettings: QuickwitSearchSettings{
-				DefaultSearchFields: []string{"source"},
+				DefaultSearchFields: []string{"source", "output"},
 			},
 		}
 

types/types.go

@@ -129,8 +129,8 @@ type Configuration struct {
 	Dynatrace          DynatraceOutputConfig
 }
 
-// InitParams represent a client parameters for initialization
-type InitParams struct {
+// InitClientArgs represent a client parameters for initialization
+type InitClientArgs struct {
 	Config          *Configuration
 	Stats           *Statistics
 	PromStats       *PromStatistics