Skip to content

Commit 9e808b4

Browse files
authored
feat(integrations/pub-sub): narrower default filter (#72)
1 parent fb8a89b commit 9e808b4

File tree

1 file changed

+22
-1
lines changed

1 file changed

+22
-1
lines changed

modules/integrations/pub-sub/variables.tf

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,28 @@ variable "exclude_logs_filter" {
8888
filter = string,
8989
disabled = optional(bool)
9090
}))
91-
default = []
91+
default = [
92+
{
93+
name = "system_principals"
94+
description = "Exclude system principals"
95+
filter = "protoPayload.authenticationInfo.principalEmail=~\"^system\\:.*\" AND (protoPayload.authenticationInfo.principalEmail!~\"^system\\:(anonymous|serviceaccount)*\" OR protoPayload.authenticationInfo.principalEmail=~\"^system\\:serviceaccount\\:kube-system\")"
96+
},
97+
{
98+
name = "k8s_audit"
99+
description = "Exclude logs from the clusters control planes"
100+
filter = "protoPayload.methodName=~\"^(io\\.k8s|io\\.traefik|us\\.containo|io\\.x-k8s|io\\.gke|org\\.projectcalico|io\\.openshift|io\\.istio)\" AND protoPayload.methodName!~\"secret\""
101+
},
102+
{
103+
name = "ciulium_control_plane"
104+
description = "Exclude operations on Cilium"
105+
filter = "protoPayload.methodName=~\"^io\\.cilium\" AND protoPayload.methodName!~\"identitites\""
106+
},
107+
{
108+
name = "monitoring_queries"
109+
description = "Exclude monitoring queries"
110+
filter = "protoPayload.methodName=~\"^com\\.coreos\""
111+
}
112+
]
92113
}
93114

94115
variable "ingestion_sink_filter" {

0 commit comments

Comments
 (0)