Fix pagerduty handler condition

Signed-off-by: KeisukeYamashita <19yamashita15@gmail.com>

README.md

@@ -44,6 +44,7 @@ Currently available outputs are :
 * [**GCP PubSub**](https://cloud.google.com/pubsub)
 * [**Google Chat**](https://workspace.google.com/products/chat/)
 * [**Apache Kafka**](https://kafka.apache.org/)
+* [**PagerDuty**](https://pagerduty.com/)
 
 ## Usage
 
@@ -268,8 +269,8 @@ kafka:
   # minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
 
 pagerduty:
-  # apikey: # Pagerduty API Key, if not empty, Pagerduty is enabled
-  service: "" # Service to create an incident
+  # apikey: # Pagerduty API Key, if not empty, Pagerduty output is enabled
+  service: "" # Service to create an incident (mandatory)
   assignee: "" # A list of comma separated users to assign. Cannot be provided if pagerduty.escalationpolicy is already specified.
   escalationpolicy: "" # Escalation policy to assign. Cannot be provided if pagerduty.escalationpolicy is already specified
   # minimumpriority: "debug" # minimum priority of event for using this output, order is emergency|alert|critical|error|warning|notice|informational|debug or "" (default)
@@ -391,6 +392,8 @@ The *env vars* "match" field names in *yaml file with this structure (**take car
 * **KAFKA_TOPIC**: The name of the Kafka topic
 * **KAFKA_PARTITION**: The number of the Kafka partition
 * **KAFKA_MINIMUMPRIORITY**: minimum priority of event for using this output, order is `emergency|alert|critical|error|warning|notice|informational|debug or "" (default)`
+* **PAGERDUTY_APIKEY**: Pagerduty API Key, if not empty, Pagerduty output is *enabled*
+* **PAGERDUTY_SERVICE**: Service to create an incident (mandatory)
 * **PAGERDUTY_ASSIGNEE**: A list of comma separated users to assign. Cannot be provided if `PAGERDUTY_ESCALATION_POLICY` is already specified. If not empty, Pagerduty is *enabled*
 * **PAGERDUTY_ESCALATION_POLICY**: Escalation policy to assign. Cannot be provided if `PAGERDUTY_ASSIGNEE` is already specified.If not empty, Pagerduty is *enabled*
 * **PAGERDUTY_MINIMUMPRIORITY**: minimum priority of event for using this output, order is `emergency|alert|critical|error|warning|notice|informational|debug or "" (default)`

config.go

@@ -197,7 +197,7 @@ func getConfig() *types.Configuration {
 	c.GCP.PubSub.MinimumPriority = checkPriority(c.GCP.PubSub.MinimumPriority)
 	c.Googlechat.MinimumPriority = checkPriority(c.Googlechat.MinimumPriority)
 	c.Kafka.MinimumPriority = checkPriority(c.Kafka.MinimumPriority)
-	c.Pagerduty.MinimumPriority = checkPriority(c.Kafka.MinimumPriority)
+	c.Pagerduty.MinimumPriority = checkPriority(c.Pagerduty.MinimumPriority)
 
 	c.Slack.MessageFormatTemplate = getMessageFormatTemplate("Slack", c.Slack.MessageFormat)
 	c.Rocketchat.MessageFormatTemplate = getMessageFormatTemplate("Rocketchat", c.Rocketchat.MessageFormat)

handlers.go

@@ -220,7 +220,7 @@ func forwardEvent(falcopayload types.FalcoPayload) {
 		go kafkaClient.KafkaProduce(falcopayload)
 	}
 
-	if (len(config.Pagerduty.Assignee) > 0 || config.Pagerduty.EscalationPolicy != "") && (priorityMap[strings.ToLower(falcopayload.Priority)] >= priorityMap[strings.ToLower(config.Pagerduty.MinimumPriority)] || falcopayload.Rule == TestRule) {
-		go kafkaClient.PagerdutyPost(falcopayload)
+	if config.Pagerduty.APIKey != "" && config.Pagerduty.Service != "" && (priorityMap[strings.ToLower(falcopayload.Priority)] >= priorityMap[strings.ToLower(config.Pagerduty.MinimumPriority)] || falcopayload.Rule == TestRule) {
+		go pagerdutyClient.PagerdutyCreateIncident(falcopayload)
 	}
 }

main.go

@@ -316,10 +316,11 @@ func init() {
 		}
 	}
 
-	if config.Pagerduty.Service != "" {
+	if config.Pagerduty.APIKey != "" && config.Pagerduty.Service != "" {
 		var err error
 		pagerdutyClient, err = outputs.NewPagerdutyClient(config, stats, promStats, statsdClient, dogstatsdClient)
 		if err != nil {
+			config.Pagerduty.APIKey = ""
 			config.Pagerduty.Service = ""
 		} else {
 			enabledOutputsText += "Pagerduty "

outputs/pagerduty.go

@@ -16,7 +16,7 @@ func NewPagerdutyClient(config *types.Configuration, stats *types.Statistics, pr
 	}
 
 	return &Client{
-		OutputType:      "GCP",
+		OutputType:      "PagerDuty",
 		Config:          config,
 		Stats:           stats,
 		PromStats:       promStats,
@@ -26,22 +26,49 @@ func NewPagerdutyClient(config *types.Configuration, stats *types.Statistics, pr
 	}, nil
 }
 
-// PagerdutyPost posts incident to Pagerduty
-func (c *Client) PagerdutyPost(falcopayload types.FalcoPayload) {
+// PagerdutyCreateIncident posts incident to Pagerduty
+func (c *Client) PagerdutyCreateIncident(falcopayload types.FalcoPayload) {
 	c.Stats.Pagerduty.Add(Total, 1)
 
-	// TODO: Implement pagerduty post
-	err := c.Post(newDatadogPayload(falcopayload))
-	if err != nil {
+	opts := &pagerduty.CreateIncidentOptions{
+		Type:  "incident",
+		Title: falcopayload.Output,
+		Service: &pagerduty.APIReference{
+			ID:   c.Config.Pagerduty.Service,
+			Type: "service_reference",
+		},
+	}
+
+	if len(c.Config.Pagerduty.Assignee) > 0 {
+		assignments := make([]pagerduty.Assignee, len(c.Config.Pagerduty.Assignee))
+		for i, a := range c.Config.Pagerduty.Assignee {
+			assignments[i] = pagerduty.Assignee{
+				Assignee: pagerduty.APIObject{
+					ID:   a,
+					Type: "user_reference",
+				},
+			}
+		}
+		opts.Assignments = assignments
+	}
+
+	if policy := c.Config.Pagerduty.EscalationPolicy; policy != "" {
+		opts.EscalationPolicy = &pagerduty.APIReference{
+			ID:   policy,
+			Type: "escalation_policy_reference",
+		}
+	}
+
+	if _, err := c.PagerdutyClient.CreateIncident("falcosidekick", opts); err != nil {
 		go c.CountMetric(Outputs, 1, []string{"output:pagerduty", "status:error"})
 		c.Stats.Pagerduty.Add(Error, 1)
 		c.PromStats.Outputs.With(map[string]string{"destination": "pagerduty", "status": Error}).Inc()
-		log.Printf("[ERROR] : Pagerduty - %v\n", err)
+		log.Printf("[ERROR] : PagerDuty - %v\n", err)
 		return
 	}
 
 	go c.CountMetric(Outputs, 1, []string{"output:pagerduty", "status:ok"})
 	c.Stats.Pagerduty.Add(OK, 1)
 	c.PromStats.Outputs.With(map[string]string{"destination": "pagerduty", "status": OK}).Inc()
-	log.Printf("[INFO] : Pagerduty - Publish OK\n")
+	log.Printf("[INFO] : Pagerduty - Create Incident OK\n")
 }