log4j-finder icon indicating copy to clipboard operation
log4j-finder copied to clipboard

feature: Added text, csv, json_event, json output capability

Open aleksandr-mironov-bose opened this issue 3 years ago • 6 comments

Added output formats:

  • text
  • json
  • csv
  • json_even

aleksandr-mironov-bose avatar Dec 20 '21 23:12 aleksandr-mironov-bose

this will implementing the script into some monitoring platform (mostly based on powershell) a whole lot easier.

Robby-Swartenbroekx avatar Dec 21 '21 07:12 Robby-Swartenbroekx

I like adding csv and json support. However this change doesn’t output the results as they are found anymore, so you have to wait until it finishes the scan.

I know streaming json output could be difficult unless it’s jsonlines. Would powershell support that or does that prefer a single json output?

yunzheng avatar Dec 21 '21 16:12 yunzheng

so you have to wait until it finishes the scan. This is OK to me, having csv output is useful and need comprise. this new enhancement should have its own argument.

tjyang avatar Dec 22 '21 03:12 tjyang

I like adding csv and json support. However this change doesn’t output the results as they are found anymore, so you have to wait until it finishes the scan.

I know streaming json output could be difficult unless it’s jsonlines. Would powershell support that or does that prefer a single json output?

In case of JSON events your system should be capable to process SerDe(https://docs.aws.amazon.com/athena/latest/ug/json-serde.html). I think that's a good idea to stream JSON events(SerDe), CSV and text. Regular JSON probably requires a scan process to finish first.

aleksandr-mironov-bose avatar Dec 24 '21 04:12 aleksandr-mironov-bose

I like adding csv and json support. However this change doesn’t output the results as they are found anymore, so you have to wait until it finishes the scan.

I know streaming json output could be difficult unless it’s jsonlines. Would powershell support that or does that prefer a single json output?

I added sync output for text, csv and json_event(SerDe). JSON output returns in the end of scan. It should at any environment(linux, windows, mac) because it doesn't have any specific execution aspects.

aleksandr-mironov-bose avatar Jan 12 '22 03:01 aleksandr-mironov-bose

@yunzheng did you have a chance to review this?

aleksandr-mironov-bose avatar Jan 25 '22 20:01 aleksandr-mironov-bose