enrich icon indicating copy to clipboard operation
enrich copied to clipboard

Javascript enrichment should write to logs via slf4j

Open istreeter opened this issue 2 years ago • 0 comments

For debugging purposes, someone might choose to add some print statements to their custom javascript enrichment:

function process(event) {
  const ipAddress = event.getUser_ipaddress
  print(ipAddress)
  return []
}

There are a couple of problems with this:

  • If the print statement runs on every event, it could send a HUGE amount of text to the logs.
  • We should avoid logging event data in production, because of PII. The example above logs the user's IP address, which would be bad.

The nashorn engine lets us capture the stdout from the enrichment and redirect it to a string. We could log this string using slf4j at debug level. This means users can add print lines for development, with logging turned on a debug level. But with production settings the debug lines do not appear in the logs.

Something like....

val sw = new StringWriter()
val context = engine.getContext()
context.setWriter(sw)
context.setErrorWriter(sw)
engine.invokeFunction(.....)
slf4jLogger.debug(sw.toString)

(that's completely untested)

istreeter avatar Apr 19 '23 13:04 istreeter