You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, when using specific known variable types, the formatter operator will add a string representation as alternative into the eBPF structure. That means that a source field defined as l4address will have a string field added as source.string, even though all other subfields of source are hidden after adding the string representation. We do this to prevent a change of the underlying type (field with subfields) caused by an operator.
Impact
source.string is unnecessarily long and causes trouble in the columns output.
Ideal future situation
source would actually be enough.
Implementation options
In order to keep the behavior of not changing the data layout depending on whether or not a specific operator is running, @alban proposed to add a _raw suffix to the eBPF field. If the formatter operator sees such a suffix, it could just remove it and use the remainder as the field name for the actual string representation and hide the _raw field.
The text was updated successfully, but these errors were encountered:
Current situation
Currently, when using specific known variable types, the formatter operator will add a string representation as alternative into the eBPF structure. That means that a
source
field defined as l4address will have astring
field added assource.string
, even though all other subfields ofsource
are hidden after adding the string representation. We do this to prevent a change of the underlying type (field with subfields) caused by an operator.Impact
source.string
is unnecessarily long and causes trouble in the columns output.Ideal future situation
source
would actually be enough.Implementation options
In order to keep the behavior of not changing the data layout depending on whether or not a specific operator is running, @alban proposed to add a
_raw
suffix to the eBPF field. If the formatter operator sees such a suffix, it could just remove it and use the remainder as the field name for the actual string representation and hide the_raw
field.The text was updated successfully, but these errors were encountered: