crowdsec
crowdsec copied to clipboard
Improvement/Have `cscli hubtest` warn you when your parser has no `evt.Meta.source_ip`
For new users, it can be quite tricky to understand that evt.Meta.source_ip is expected for most event types, and things can get wrong easily when creating one.
I guess having cscli hubtest warn you when :
- your parser doesn't generate a
Meta.source_ip - your scenario's filter or group_by matches on a missing key
- When evt.StrTime is not filled It would be really useful