feat: add multi line option

Yamato-Security · Nov 12, 2024 · 90ed4e1 · 90ed4e1
1 parent 89f453f
commit 90ed4e1
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/src/detections/configs.rs b/src/detections/configs.rs
@@ -373,6 +373,7 @@ impl StoredStatic {
         let multiline_flag = match &input_config.as_ref().unwrap().action {
             Some(Action::CsvTimeline(opt)) => opt.multiline,
             Some(Action::Search(opt)) => opt.multiline,
+            Some(Action::LogMetrics(opt)) => opt.multiline,
             _ => false,
         };
         let proven_rule_flag = match &input_config.as_ref().unwrap().action {
@@ -1769,6 +1770,10 @@ pub struct LogMetricsOption {
     #[clap(flatten)]
     pub time_format_options: TimeFormatOptions,
 
+    /// Output event field information in multiple rows for CSV output
+    #[arg(help_heading = Some("Output"), short = 'M', long="multiline", display_order = 390)]
+    pub multiline: bool,
+
     /// Overwrite files when saving
     #[arg(help_heading = Some("General Options"), short='C', long = "clobber", display_order = 290, requires = "output")]
     pub clobber: bool,

diff --git a/src/timeline/timelines.rs b/src/timeline/timelines.rs
@@ -582,6 +582,11 @@ impl Timeline {
         {
             return None;
         }
+        let sep = if stored_static.multiline_flag {
+            "\n"
+        } else {
+            sep
+        };
         let ab_ch: Vec<String> = rec
             .channels
             .iter()