From 33145a2b0b21654d8442b506288fbea5db5f42ad Mon Sep 17 00:00:00 2001 From: A Gardner <3100188+actgardner@users.noreply.github.com> Date: Mon, 30 Sep 2019 17:33:15 -0400 Subject: [PATCH] Don't produce duplicate entries when events have non-string fields --- outputs/alertmanager.go | 2 ++ outputs/client_test.go | 2 +- outputs/slack.go | 2 ++ outputs/teams.go | 2 ++ 4 files changed, 7 insertions(+), 1 deletion(-) diff --git a/outputs/alertmanager.go b/outputs/alertmanager.go index 81ca8d188..32e3562a5 100644 --- a/outputs/alertmanager.go +++ b/outputs/alertmanager.go @@ -26,6 +26,8 @@ func newAlertmanagerPayload(falcopayload types.FalcoPayload) []alertmanagerPaylo case string: //AlertManger doesn't support dots in a label name amPayload.Labels[strings.Replace(i, ".", "_", -1)] = j.(string) + default: + continue } } amPayload.Labels["source"] = "falco" diff --git a/outputs/client_test.go b/outputs/client_test.go index 0503ce2ed..eeaa9672e 100644 --- a/outputs/client_test.go +++ b/outputs/client_test.go @@ -11,7 +11,7 @@ import ( "github.com/falcosecurity/falcosidekick/types" ) -var falcoTestInput = `{"output":"This is a test from falcosidekick","priority":"Debug","rule":"Test rule", "time":"2001-01-01T01:10:00Z","output_fields": {"proc.name":"falcosidekick","user.name":"falcosidekick"}}` +var falcoTestInput = `{"output":"This is a test from falcosidekick","priority":"Debug","rule":"Test rule", "time":"2001-01-01T01:10:00Z","output_fields": {"proc.name":"falcosidekick","user.name":"falcosidekick", "proc.tty": 1234}}` func TestNewClient(t *testing.T) { u, _ := url.Parse("http://localhost") diff --git a/outputs/slack.go b/outputs/slack.go index 50bcc1f84..ccedf017b 100644 --- a/outputs/slack.go +++ b/outputs/slack.go @@ -47,6 +47,8 @@ func newSlackPayload(falcopayload types.FalcoPayload, config *types.Configuratio } else { field.Short = false } + default: + continue } fields = append(fields, field) } diff --git a/outputs/teams.go b/outputs/teams.go index dd19e51e2..cbe0e17fd 100644 --- a/outputs/teams.go +++ b/outputs/teams.go @@ -50,6 +50,8 @@ func newTeamsPayload(falcopayload types.FalcoPayload, config *types.Configuratio case string: fact.Name = i fact.Value = j.(string) + default: + continue } facts = append(facts, fact) }