CLI filter with container name

[errordeveloper]

Is there an existing issue for this?

• [x] I have searched the existing issues

Is your feature request related to a problem?

No response

Describe the feature you would like

To be able to do some quick things with CLI it'd be very handy to specify a container name.

There is no jq inside the tetragon pod, which and even having installed it one needs to figure out a filter expression and cover the types of events user is interested in also. It's also not obvious that one can use compact output format using a pipe. It'd be easier if there was a flag.

Here is what I had to use:

tetra getevents --namespace foo --pod=foo 
   | jq 'select(.process_exec.process.pod.container.name == "bar", .process_exit.process.pod.container.name == "bar")'
   | tetra getevents -o compact

It's workable, but having a simple flag would have been nicer, of course.

Describe your proposed solution

No response

Code of Conduct

• [x] I agree to follow this project's Code of Conduct

[mtardy]

Hey, thank you for the suggestion, sure! Looks like a good first issue someone could pick. You can implement it as well if you have the time.

[prateek041]

Hello Tetragon team, I would love to pick this up if no one else is working on this.

[FedeDP]

Ehy, since this issue was stale for many months, i went on and opened a PR to fix it: https://github.com/cilium/tetragon/pull/4051 Unfortunately @prateek041 i didn't notice your open PR, sorry. We chose a different path though, let me know if you wish me to close mine; otherwise i'd just let maintainers choose.