Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

adding filter processor in receiver and collector #10

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

adding filter processor in receiver and collector #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions example/collector-builder.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ processors:
- gomod: go.opentelemetry.io/collector/processor/batchprocessor v0.81.0
- gomod: github.com/open-telemetry/opentelemetry-collector-contrib/processor/attributesprocessor v0.81.0
- gomod: github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourceprocessor v0.81.0
- gomod: github.com/open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor v0.81.0

replaces:
- github.com/kubearmor/OTel-receiver/kubearmor_receiver => ../kubearmor_receiver
Expand Down
10 changes: 8 additions & 2 deletions example/collector-k8-manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,19 @@ spec:
verbosity: detailed
loki:
endpoint: "http://loki.default.svc:3100/loki/api/v1/push"

processors:
filter/ottl:
error_mode: ignore
logs:
log_record:
- 'not (IsMatch(body, ".*Permission denied.*"))'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Shashankft9 Thank you for the PR! 🚀
Though this method to filter logs will work however it shouldn't be handled this way ideally. It's because there is logic for filtering already present in Kubearmor.

Kubearmor emits separate streams for logs (generic events) and alerts (policy events). So a good place to investigate will be why the adapter can't subscribe to just a single stream based on the configuration passed.
The relevant code -

otel-adapter/stanza_input_operator/input_operator.go

Line 131 in 9f702ef

if logfilter == "all" || logfilter == "policy" {

service:
pipelines:
logs:
receivers:
- kubearmor_receiver
processors: []
processors:
- filter/ottl
exporters:
- loki
- logging
Expand Down