Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(promtail): Adding S3 log parser support for AWS GuardDuty (#13148) #13186

Conversation

samuelebstein
Copy link
Contributor

@samuelebstein samuelebstein commented Jun 10, 2024

This pull request introduces the following changes to the lambda-promtail module:

  1. Adding Terraform Variable:

    • Introduces a new Terraform variable to allow a different filter suffix for the S3 bucket notification resource. This enhancement provides more flexibility in configuring S3 bucket notifications.
  2. Adding GuardDuty Log Type:

    • Adds support for parsing GuardDuty log types in the S3 log parser. This ensures that Promtail can push GuardDuty findings logs to Loki for monitoring and analysis.

Which issue(s) this PR fixes:
Fixes # #13129

Why this PR is needed

  • The addition of the filter suffix variable allows users to customize the suffix used for S3 bucket notifications, which is particularly useful for different logging requirements and setups.
  • Including GuardDuty log types in the S3 log parser expands Promtail's capabilities, enabling it to handle and forward GuardDuty findings logs, which are crucial for security monitoring.

Checklist

  • Added the new Terraform variable to the lambda-promtail module.
  • Updated the S3 log parser to include GuardDuty log types.
  • Tested the changes to ensure they work as expected.
  • Updated documentation.

Upgrading Steps

If these changes affect the default configuration, metrics names, log lines used in dashboards or alerts, configuration parameters, or API endpoints, please document what has changed and what needs to be done in the upgrade guide.

  • Default configuration values: None affected.
  • Metric names or label names: None affected.
  • Changes to existing log lines: None affected.
  • Configuration parameters: Added new variable for filter suffix with default value that is the same as the previously hardcoded value.
  • Breaking changes to HTTP or gRPC API endpoints: None.

Please review the changes and let me know if there are any questions or concerns. Thank you!

…na#13148)

Co-authored-by: James Callahan <https://github.com/james-callahan>ase enter the commit message for your changes. Lines starting
@cstyan
Copy link
Contributor

cstyan commented Jul 16, 2024

duplicate of #13148

@cstyan cstyan closed this Jul 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants