crowdsec icon indicating copy to clipboard operation
crowdsec copied to clipboard

Improvement/Have `cscli hubtest` warn you when your parser has no `evt.Meta.source_ip`

Open buixor opened this issue 3 years ago • 0 comments

For new users, it can be quite tricky to understand that evt.Meta.source_ip is expected for most event types, and things can get wrong easily when creating one.

I guess having cscli hubtest warn you when :

  • your parser doesn't generate a Meta.source_ip
  • your scenario's filter or group_by matches on a missing key
  • When evt.StrTime is not filled It would be really useful

buixor avatar May 24 '22 12:05 buixor