enrich
enrich copied to clipboard
Javascript enrichment should write to logs via slf4j
For debugging purposes, someone might choose to add some print statements to their custom javascript enrichment:
function process(event) {
const ipAddress = event.getUser_ipaddress
print(ipAddress)
return []
}
There are a couple of problems with this:
- If the
printstatement runs on every event, it could send a HUGE amount of text to the logs. - We should avoid logging event data in production, because of PII. The example above logs the user's IP address, which would be bad.
The nashorn engine lets us capture the stdout from the enrichment and redirect it to a string. We could log this string using slf4j at debug level. This means users can add print lines for development, with logging turned on a debug level. But with production settings the debug lines do not appear in the logs.
Something like....
val sw = new StringWriter()
val context = engine.getContext()
context.setWriter(sw)
context.setErrorWriter(sw)
engine.invokeFunction(.....)
slf4jLogger.debug(sw.toString)
(that's completely untested)