feat(forwarder): add preset for VPC Flow Logs (#229)

Identify VPC Flow Logs with a custom content type.
observeinc · Apr 19, 2024 · d07fad9 · d07fad9
1 parent cc97274
commit d07fad9
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/handler/forwarder/override/presets/aws/v1.yaml b/handler/forwarder/override/presets/aws/v1.yaml
@@ -34,3 +34,10 @@
     source: '\d{12}_CloudTrail_[a-z\d-]+_\d{8}T\d{4}Z_[a-zA-Z0-9-]+\.json\.gz$'
   override:
     content-type: 'application/x-aws-cloudtrail'
+
+- id: vpcFlowLogs
+  match:
+    source: '\d{12}_vpcflowlogs_[a-z\d-]+_[a-zA-Z0-9-]+_\d{8}T\d{4}Z_[a-zA-Z0-9-]+\.log\.gz$'
+  override:
+    content-type: 'application/x-aws-vpcflowlogs'
+
diff --git a/handler/forwarder/override/presets_test.go b/handler/forwarder/override/presets_test.go
@@ -60,6 +60,18 @@ func TestPresets(t *testing.T) {
 						MetadataDirective: types.MetadataDirectiveReplace,
 					},
 				},
+				{
+					Input: &s3.CopyObjectInput{
+						CopySource:      aws.String("test-bucket/AWSLogs/123456789012/vpcflowlogs/eu-central-1/2024/04/18/123456789012_vpcflowlogs_eu-central-1_fl-0d867ec290a114c9d_20240418T2155Z_9b1b75d1.log.gz"),
+						ContentEncoding: aws.String("gzip"),
+					},
+					Expect: &s3.CopyObjectInput{
+						CopySource:        aws.String("test-bucket/AWSLogs/123456789012/vpcflowlogs/eu-central-1/2024/04/18/123456789012_vpcflowlogs_eu-central-1_fl-0d867ec290a114c9d_20240418T2155Z_9b1b75d1.log.gz"),
+						ContentType:       aws.String("application/x-aws-vpcflowlogs"),
+						ContentEncoding:   aws.String("gzip"),
+						MetadataDirective: types.MetadataDirectiveReplace,
+					},
+				},
 			},
 		},
 	}