Sensu Event Streamliner

Table of Contents

• Overview
• Usage examples
• Configuration
  • Asset registration
  • Mutator definition
• Installation from source
• Contributing

Overview

The Sensu Event Streamliner is a Sensu Mutator that removes certain redundant event information
that may not be needed in certain situations (e.g. sending off to an event indexer).

The event fields removed are:

• event.Entity.Redact
• event.Entity.System.Network.Interfaces
• event.Entity.Subscriptions
• event.Check.Handlers
• event.Check.History
• event.Check.RuntimeAssets
• event.Check.Subscriptions

My anecdotal testing has shown that this reduces the event payload by between one and two KiB per event.

Usage examples

There are no arguments to this mutator, so the usage is quite simple.

Sensu Event Streamliner

Usage:
  sensu-event-streamliner [flags]
  sensu-event-streamliner [command]

Available Commands:
  help        Help about any command
  version     Print the version number of this plugin

Flags:
  -h, --help   help for sensu-event-streamliner

Use "sensu-event-streamliner [command] --help" for more information about a command.

Configuration

Asset registration

Sensu Assets are the best way to make use of this plugin. If you're not using an asset, please
consider doing so! If you're using sensuctl 5.13 with Sensu Backend 5.13 or later, you can use the
following command to add the asset:

sensuctl asset add nixwiz/sensu-event-streamliner

If you're using an earlier version of sensuctl, you can find the asset on the Bonsai Asset Index

Mutator definition

---
type: Mutator
api_version: core/v2
metadata:
  name: sensu-event-streamliner
  namespace: default
spec:
  command: sensu-event-streamliner
  runtime_assets:
  - nixwiz/sensu-event-streamliner

Handler definition

---
type: Handler
api_version: core/v2
metadata:
  name: pushover
  namespace: default
spec:
  command: sensu-go-pushover-handler
  env_vars: null
  filters:
  - is_incident
  - not_silenced
  - fatigue_check
  handlers: null
  mutator: sensu-event-streamliner
  runtime_assets:
  - nixwiz/sensu-go-pushover-handler
  timeout: 10
  type: pipe

Installation from source

The preferred way of installing and deploying this plugin is to use it as an Asset. If you would
like to compile and install the plugin from source or contribute to it, download the latest version
or create an executable binary from this source.

From the local path of the sensu-event-streamliner repository:

go build

Contributing

For more information about contributing to this plugin, see Contributing.