Sensu Event Streamliner

Table of Contents

• Overview
• Usage examples
• Configuration
  • Asset registration
  • Mutator definition
• Installation from source
• Contributing

Overview

The Sensu Event Streamliner is a Sensu Mutator that removes certain
redundant event information that may not be needed in certain situations
(e.g. sending off to an event indexer).

The event fields removed are:

• event.Entity.Redact
• event.Entity.System.Network.Interfaces
• event.Entity.Subscriptions
• event.Check.Handlers
• event.Check.History
• event.Check.RuntimeAssets
• event.Check.Subscriptions

My anecdotal testing has shown that this reduces the event payload sent to a
handler by between one and two KiB per event.

Usage examples

There are no arguments to this mutator, so the usage is quite simple.

Sensu Event Streamliner

Usage:
  sensu-event-streamliner [flags]
  sensu-event-streamliner [command]

Available Commands:
  help        Help about any command
  version     Print the version number of this plugin

Flags:
  -h, --help   help for sensu-event-streamliner

Use "sensu-event-streamliner [command] --help" for more information about a command.

Configuration

Asset registration

Sensu Assets are the best way to make use of this plugin. If you're not
using an asset, please consider doing so! If you're using sensuctl 5.13 with
Sensu Backend 5.13 or later, you can use the following command to add the asset:

sensuctl asset add nixwiz/sensu-event-streamliner

If you're using an earlier version of sensuctl, you can find the asset on the
Bonsai Asset Index

Mutator definition

---
type: Mutator
api_version: core/v2
metadata:
  name: sensu-event-streamliner
  namespace: default
spec:
  command: sensu-event-streamliner
  runtime_assets:
  - nixwiz/sensu-event-streamliner

Handler definition

---
type: Handler
api_version: core/v2
metadata:
  name: pushover
  namespace: default
spec:
  command: sensu-go-pushover-handler
  env_vars: null
  filters:
  - is_incident
  - not_silenced
  - fatigue_check
  handlers: null
  mutator: sensu-event-streamliner
  runtime_assets:
  - nixwiz/sensu-go-pushover-handler
  timeout: 10
  type: pipe

Installation from source

The preferred way of installing and deploying this plugin is to use it as an
Asset. If you would like to compile and install the plugin from source or
contribute to it, download the latest version or create an executable binary
from this source.

From the local path of the sensu-event-streamliner repository:

go build

Contributing

For more information about contributing to this plugin, see Contributing.