add settings for adding extra labels for loki and prometheu series

Signed-off-by: Issif <issif+github@gadz.org>

README.md

@@ -250,6 +250,7 @@ loki:
   # checkcert: true # check if ssl certificate of the output is valid (default: true)
   # tenant: "" # Add the tenant header if needed. Enabled if not empty
   # endpoint: "/api/prom/push" # The endpoint URL path, default is "/api/prom/push" more info : https://grafana.com/docs/loki/latest/api/#post-apiprompush
+  # extralabels: "" # comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields
 
 stan:
   # hostport: "" # nats://{domain or ip}:{port}, if not empty, STAN output is enabled
@@ -300,6 +301,9 @@ smtp:
   # outputformat: "" # html (default), text
   # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
 
+prometheus:
+  # extralabels: "" # comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields
+
 statsd:
   forwarder: "" # The address for the StatsD forwarder, in the form "host:port", if not empty StatsD is enabled
   namespace: "falcosidekick." # A prefix for all metrics (default: "falcosidekick.")
@@ -612,6 +616,7 @@ care of lower/uppercases**) : `yaml: a.b --> envvar: A_B` :
 - **LOKI_TENANT** : Loki tenant, if not `empty`, Loki tenant is _enabled_
 - **LOKI_ENDPOINT** : Loki endpoint URL path, default is "/api/prom/push" more info : https://grafana.com/docs/loki/latest/api/#post-apiprompush
 - **NATS_HOSTPORT** : NATS "nats://host:port", if not `empty`, NATS is _enabled_
+- **LOKI_EXTRALABELS** : comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields
 - **NATS_MINIMUMPRIORITY** : minimum priority of event for using this output,
   order is
   `emergency|alert|critical|error|warning|notice|informational|debug or "" (default)`
@@ -682,6 +687,7 @@ care of lower/uppercases**) : `yaml: a.b --> envvar: A_B` :
 - **OPSGENIE_MINIMUMPRIORITY** : minimum priority of event for using this
   output, order is
   `emergency|alert|critical|error|warning|notice|informational|debug or "" (default)`
+- **PROMETHEUS_EXTRALABELS**: comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields
 - **STATSD_FORWARDER**: The address for the StatsD forwarder, in the form
   http://host:port, if not empty StatsD is _enabled_
 - **STATSD_NAMESPACE**: A prefix for all metrics (default: "falcosidekick.")

config.go

@@ -120,6 +120,7 @@ func getConfig() *types.Configuration {
 	v.SetDefault("Loki.CheckCert", true)
 	v.SetDefault("Loki.Tenant", "")
 	v.SetDefault("Loki.Endpoint", "/api/prom/push")
+	v.SetDefault("Loki.ExtraLabels", "")
 
 	v.SetDefault("AWS.AccessKeyID", "")
 	v.SetDefault("AWS.SecretAccessKey", "")
@@ -177,6 +178,8 @@ func getConfig() *types.Configuration {
 	v.SetDefault("Statsd.Forwarder", "")
 	v.SetDefault("Statsd.Namespace", "falcosidekick.")
 
+	v.SetDefault("Prometheus.ExtraLabels", "")
+
 	v.SetDefault("Dogstatsd.Forwarder", "")
 	v.SetDefault("Dogstatsd.Namespace", "falcosidekick.")
 	v.SetDefault("Dogstatsd.Tags", []string{})
@@ -376,6 +379,14 @@ func getConfig() *types.Configuration {
 		log.Fatalf("[ERROR] : Failed to parse ListenAddress")
 	}
 
+	if c.Loki.ExtraLabels != "" {
+		c.Loki.ExtraLabelsList = strings.Split(strings.ReplaceAll(c.Loki.ExtraLabels, " ", ""), ",")
+	}
+
+	if c.Prometheus.ExtraLabels != "" {
+		c.Prometheus.ExtraLabelsList = strings.Split(strings.ReplaceAll(c.Loki.ExtraLabels, " ", ""), ",")
+	}
+
 	c.Slack.MinimumPriority = checkPriority(c.Slack.MinimumPriority)
 	c.Rocketchat.MinimumPriority = checkPriority(c.Rocketchat.MinimumPriority)
 	c.Mattermost.MinimumPriority = checkPriority(c.Mattermost.MinimumPriority)

config_example.yaml

@@ -1,7 +1,7 @@
 #listenaddress: "" # ip address to bind falcosidekick to (default: "" meaning all addresses)
 #listenport: 2801 # port to listen for daemon (default: 2801)
 debug: false # if true all outputs will print in stdout the payload they send (default: false)
-customfields: # custom fields are added to falco events
+customfields: # custom fields are added to falco events and metrics
   Akey: "AValue"
   Bkey: "BValue"
   Ckey: "CValue"
@@ -83,6 +83,7 @@ loki:
   # checkcert: true # check if ssl certificate of the output is valid (default: true)
   # tenant: "" # Add the tenant header if needed. Tenant header is enabled only if not empty
   # endpoint: "/api/prom/push" # The endpoint URL path, default is "/api/prom/push" more info : https://grafana.com/docs/loki/latest/api/#post-apiprompush
+  # extralabels: "" # comma separated list of fields to use as labels additionnally to rule, source, priority, tags and custom_fields
 
 nats:
   # hostport: "" # nats://{domain or ip}:{port}, if not empty, NATS output is enabled
@@ -133,6 +134,9 @@ smtp:
   # outputformat: "" # html (default), text
   # minimumpriority: "" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
 
+prometheus:
+  # extralabels: "" # comma separated list of fields to use as labels additionnally to rule, source, priority, tags and custom_fields
+
 statsd:
   forwarder: "" # The address for the StatsD forwarder, in the form "host:port", if not empty StatsD is enabled
   namespace: "falcosidekick." # A prefix for all metrics (default: "falcosidekick.")

outputs/loki.go

@@ -33,7 +33,9 @@ func newLokiPayload(falcopayload types.FalcoPayload, config *types.Configuration
 	for i, j := range falcopayload.OutputFields {
 		switch v := j.(type) {
 		case string:
-			s += strings.ReplaceAll(strings.ReplaceAll(strings.ReplaceAll(i, ".", ""), "]", ""), "[", "") + "=\"" + strings.ReplaceAll(v, "\"", "") + "\","
+			if contains(config.Loki.ExtraLabelsList, i) {
+				s += strings.ReplaceAll(strings.ReplaceAll(strings.ReplaceAll(i, ".", ""), "]", ""), "[", "") + "=\"" + strings.ReplaceAll(v, "\"", "") + "\","
+			}
 		default:
 			continue
 		}

outputs/loki_test.go

@@ -13,7 +13,7 @@ func TestNewLokiPayload(t *testing.T) {
 	expectedOutput := lokiPayload{
 		Streams: []lokiStream{
 			{
-				Labels: "{procname=\"falcosidekick\",tags=\"test,example\",rule=\"Test rule\",source=\"syscalls\",priority=\"Debug\"}",
+				Labels: "{tags=\"test,example\",rule=\"Test rule\",source=\"syscalls\",priority=\"Debug\"}",
 				Entries: []lokiEntry{
 					{
 						Ts:   "2001-01-01T01:10:00Z",

outputs/utils.go

@@ -15,3 +15,12 @@ func getSortedStringKeys(m map[string]interface{}) []string {
 	sort.Strings(keys)
 	return keys
 }
+
+func contains(slice []string, str string) bool {
+	for _, i := range slice {
+		if i == str {
+			return true
+		}
+	}
+	return false
+}

stats_prometheus.go

@@ -44,6 +44,7 @@ func getFalcoNewCounterVec(config *types.Configuration) *prometheus.CounterVec {
 		"k8s_ns_name",
 		"k8s_pod_name",
 	}
+	labelnames = append(labelnames, config.Prometheus.ExtraLabelsList...)
 	for key := range config.Customfields {
 		matched, err := regexp.MatchString("^[a-zA-Z_:][a-zA-Z0-9_:]*$", key)
 		if err != nil {

types/types.go

@@ -27,6 +27,7 @@ type Configuration struct {
 	ListenAddress      string
 	ListenPort         int
 	Customfields       map[string]string
+	Prometheus         prometheusOutputConfig
 	Slack              SlackOutputConfig
 	Cliq               CliqOutputConfig
 	Mattermost         MattermostOutputConfig
@@ -195,6 +196,13 @@ type lokiOutputConfig struct {
 	MutualTLS       bool
 	Tenant          string
 	Endpoint        string
+	ExtraLabels     string
+	ExtraLabelsList []string
+}
+
+type prometheusOutputConfig struct {
+	ExtraLabels     string
+	ExtraLabelsList []string
 }
 
 type natsOutputConfig struct {