Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow specifying a custom regex pattern for the s3-logfile module #77

Open
jasonwalsh opened this issue Nov 25, 2024 · 3 comments
Open
Labels
type: enhancement New feature or request

Comments

@jasonwalsh
Copy link

jasonwalsh commented Nov 25, 2024

I mentioned this in our support Slack channel and was told to create a new issue to resurface #68.

We use the s3-logfile Terraform module to deploy the Honeycomb agentless-integrations-for-aws to send VPC flow logs to a dataset. The solution works great. Would it be possible to accommodate for more than the version 2 fields? Right now, the regex pattern is:

(?P<version>\d+) (?P<account_id>\d+) (?P<interface_id>eni-[0-9a-f]+) (?P<src_addr>[\d\.]+) (?P<dst_addr>[\d\.]+) (?P<src_port>\d+) (?P<dst_port>\d+) (?P<protocol>\d+) (?P<packets>\d+) (?P<bytes>\d+) (?P<start_time>\d+) (?P<end_time>\d+) (?P<action>[A-Z]+) (?P<log_status>[A-Z]+)

Including fields such as type (IPv4 or IPv6) and pkt-dst-aws-service (EC2, CLOUDFRONT, ROUTE53, etc.) would be helpful. The Terraform module does not include a way to specify custom regex.

@TylerHelmuth
Copy link

@jasonwalsh can you fix the version 2 link?

@TylerHelmuth TylerHelmuth added the type: enhancement New feature or request label Nov 25, 2024
@TylerHelmuth
Copy link

Also thanks for opening this idea, we'll take a look in-depth next week after the holiday. Do you have any interest in submitting a PR if we accept this idea?

@jasonwalsh
Copy link
Author

@TylerHelmuth, I fixed the link. I'll look into submitting a PR if I have time before Thanksgiving.

@TylerHelmuth TylerHelmuth added status: oncall Flagged for awareness from Honeycomb Telemetry Oncall and removed status: oncall Flagged for awareness from Honeycomb Telemetry Oncall labels Dec 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants