fix inconsistent datasource references

Author: lsibilla

rules/cre-2024-0021/keda-nil-pointer.yaml

@@ -40,7 +40,7 @@ rules:
       set:
         window: 5s
         event:
-          source: cre.log.keda-operator.2.*
+          source: cre.log.keda-operator
         match:
           - value: "ResolveScaleTargetPodSpec"
           - value: "scale_resolvers.go"

rules/cre-2025-0028/opentelemetry-python-fails-to.yaml

@@ -38,7 +38,7 @@ rules:
   rule:
     set:
       event:
-        source: cre.log.opentelemetry-python
+        source: cre.log.opentelemetry-collector
       window: 5s
       match:
         - value: ERROR opentelemetry.context:Failed to detach context

rules/cre-2025-0088/nats-slow-consumer-concise.yaml

@@ -47,7 +47,7 @@ rules:
     rule:
       set:
         event:
-          source: cre.log.nats.jetstream
+          source: cre.log.nats
         match:
           - regex: '(?i)jetstream\s+failed\s+to\s+store.*maximum\s+bytes\s+exceeded'
             count: 1

rules/cre-2025-0090/loki-log-line-long.yaml

@@ -51,6 +51,6 @@ rules:
     rule:
       set: # Using 'set' for single event matching, as it's a single log line detection
         event:
-          source: Alloy log
+          source: cre.log.alloy
         match:
           - regex: level=error(.+)final error sending batch(.+)component_id=loki\.write\.endpoint(.+)error(.+)server returned HTTP status 400 Bad Request(.+)Max entry size(.+)exceeded for stream

rules/cre-2025-0104/istio-ambient-xds.yaml

@@ -42,7 +42,7 @@ rules:
     rule:
       set:
         event:
-          source: cre.log.ambient
+          source: cre.log.istiod
         match:
           - regex: "timed out waiting for workload .* from xds"
         negate:

rules/cre-2025-0106/ambient-cni-sandbox-creation-failure.yaml

@@ -49,7 +49,7 @@ rules:
       set:
         window: 60s
         event:
-          source: cre.log.ambient
+          source: cre.kubernetes
         match:
           - regex: "FailedCreatePodSandBox"
           - regex: "no ztunnel connection"

rules/cre-2025-0108/istio-readiness-probe.yaml

@@ -46,7 +46,7 @@ rules:
       set:
         window: 300s
         event:
-          source: cre.log.ambient
+          source: cre.kubernetes
         match:
           - regex: "Readiness probe failed:"
             count: 4

rules/cre-2025-0109/istio-ambient-status-codes.yaml

@@ -44,7 +44,7 @@ rules:
     rule:
       set:
         event:
-          source: cre.log.ambient
+          source: cre.log.istio-proxy
         match:
           - regex: "status=(?:4[0-9]{2}|5[0-9]{2})"
         negate: []

rules/cre-2025-0110/ztunnel-traffic.yaml

@@ -43,7 +43,7 @@ rules:
       set:
         window: 180s
         event:
-          source: cre.log.ambient
+          source: cre.log.istio-proxy
         match:
         - regex: 'error +access +connection +complete +.*error="io error: deadline has elapsed"'
         - regex: 'error +access +connection +complete +.*error="connection timed out, maybe a NetworkPolicy is blocking HBONE port 15008: deadline has elapsed"'

rules/cre-2025-0115/mongodb.yaml

@@ -38,7 +38,7 @@ rules:
     rule:
       set:
         event:
-          source: mongodb
+          source: cre.log.mongodb
         match:
           - regex: "Slow query"
         negate: