Thomas Labarussias
Thomas Labarussias
Hello, I don't understand exactly what you're trying to do. In your example, is `k8s.ns.labels.foo` the label of the namespace of Falco or of the namespace of the Pod within...
If `-p fizz=%k8s.pod.label.foo` adds an item in the `output` but `fizz: example` isn't present in the `output_fields`, it means the issue is at Falco level. Falcosidekick has only what Falco...
Ok, now I see what you're talking about. I'll try to propose you something asap.
Here's the current status of my tests. With these settings: ```yaml templatedfields: # templated fields are added to falco events and metrics Dkey: '{{ or (index . "k8s.ns.labels.foo") "bar" }}'...
Hello, No caching for now, if one output is unavailable, an error message is printed and that's all. For now, nobody asked for that feature, and we may think about....
> Does that mean, that the logs the falco instances have generated will be dropped if the output isn't available? Exactly. I get your point, that something we may think...
/remove-lifecycle rotten
/remove-lifecycle stale
@gauravgahlot This is not already taken but I wanted to have it (from me or else) for v3 release. It may change the log format and break indexation of logs...
Hello @mercion I support every new output, feel free to propose a PR, we'll review it for sure. Thanks.