new(userspace): added new addOutput json entry for plugin get_field() API

userspace/libsinsp/filter_field.h

@@ -50,6 +50,7 @@ enum filtercheck_field_flags {
 	        1 << 13,  ///< data pointers extracted by this field may change across subsequent
 	                  ///< extractions (even of other fields), which makes them unsafe to be used
 	                  ///< with filter caching or field-to-field comparisons
+	EPF_FORMAT_SUGGESTED = 1 << 14,  ///< this field is suggested to be used as output field
 };
 
 /**
@@ -105,6 +106,11 @@ struct filtercheck_field_info {
 	// through a memory buffer copy (e.g. with a FTR_STORAGE transformer)
 	//
 	inline bool is_ptr_unstable() const { return m_flags & EPF_NO_PTR_STABILITY; }
+
+	//
+	// Returns true if this field is a suggested as output
+	//
+	inline bool is_format_suggested() const { return m_flags & EPF_FORMAT_SUGGESTED; }
 };
 
 /**

userspace/libsinsp/plugin.cpp

@@ -513,6 +513,20 @@
 				}
 			}
 
+			const Json::Value& jvoutput = root[j].get("addOutput", Json::Value::null);
+			if(!jvoutput.isNull()) {
+				if(!jvoutput.isBool()) {
+					throw sinsp_exception(string("error in plugin ") + name() + ": field " + fname +
+					                      " addOutput property is not boolean ");
+				}
+
+				if(jvoutput.asBool()) {
+					tf.m_flags = (filtercheck_field_flags)((int)tf.m_flags |
+					                                       (int)filtercheck_field_flags::
+					                                               EPF_FORMAT_SUGGESTED);
+				}
+			}
+
 			resolve_dylib_field_arg(root[j].get("arg", Json::Value::null), tf);
 
 			const Json::Value& jvProperties = root[j].get("properties", Json::Value::null);

userspace/libsinsp/test/plugins.ut.cpp

@@ -155,6 +155,16 @@ TEST_F(sinsp_with_test_input, plugin_syscall_extract) {
 	// This plugin tells that it can receive `syscall` events
 	add_plugin_filterchecks(&m_inspector, pl, sinsp_syscall_event_source_name, pl_flist);
 
+	// Since `%ample.is_open` field was requested by the plugin as an addOutput field,
+	// its filtercheck should have the EPF_FORMAT_SUGGESTED flag..
+	std::vector<const filter_check_info*> fields;
+	pl_flist.get_all_fields(fields);
+	for(const auto& field : fields) {
+		if(field->m_name == "sample.is_open") {
+			ASSERT_TRUE(field->m_flags & EPF_FORMAT_SUGGESTED);
+		}
+	}
+
 	// Open the inspector in test mode
 	add_default_init_thread();
 	open_inspector();
@@ -346,6 +356,16 @@ TEST_F(sinsp_with_test_input, plugin_custom_source) {
 	// the GENERIC platform type does not fill in machine_info
 	ASSERT_EQ(m_inspector.get_machine_info()->num_cpus, 0);
 
+	// Since `%sample.hello` field was requested by the plugin as an addOutput field,
+	// its value should be present in the output.
+	std::vector<const filter_check_info*> fields;
+	filterlist.get_all_fields(fields);
+	for(const auto& field : fields) {
+		if(field->m_name == "sample.hello") {
+			ASSERT_TRUE(field->m_flags & EPF_FORMAT_SUGGESTED);
+		}
+	}
+
 	auto evt = next_event();
 	ASSERT_NE(evt, nullptr);
 	ASSERT_EQ(evt->get_type(), PPME_PLUGINEVENT_E);

userspace/libsinsp/test/plugins/plugin_extract.cpp

@@ -64,7 +64,7 @@ const char* plugin_get_contact() {
 const char* plugin_get_fields() {
 	return "["
 	       "{\"type\": \"string\", \"name\": \"sample.hello\", \"desc\": \"A constant hello world "
-	       "string\"}"
+	       "string\", \"addOutput\": true}"
 	       "]";
 }
 

userspace/libsinsp/test/plugins/syscall_extract.cpp

@@ -86,7 +86,8 @@ const char* plugin_get_fields() {
 	{
 		"type": "uint64",
 		"name": "sample.is_open",
-		"desc": "Value is 1 if event is of open family"
+		"desc": "Value is 1 if event is of open family",
+		"addOutput": true
 	},
 	{
 		"type": "uint64",

userspace/plugin/plugin_api.h

@@ -29,7 +29,7 @@ extern "C" {
 //
 // todo(jasondellaluce): when/if major changes to v4, check and solve all todos
 #define PLUGIN_API_VERSION_MAJOR 3
-#define PLUGIN_API_VERSION_MINOR 7
+#define PLUGIN_API_VERSION_MINOR 8
 #define PLUGIN_API_VERSION_PATCH 0
 
 //
@@ -843,7 +843,7 @@ typedef struct {
 		//     "name": a string with a name for the field
 		//     "type": one of "string", "uint64", "bool", "reltime", "abstime",
 		//             "ipaddr", "ipnet"
-		//     "isList: (optional) If present and set to true, notes
+		//     "isList: (optional) if present and set to true, notes
 		//              that the field extracts a list of values.
 		//     "arg": (optional) if present, notes that the field can accept
 		//             an argument e.g. field[arg]. More precisely, the following
@@ -860,9 +860,11 @@ typedef struct {
 		//                display the field instead of the name. Used in tools
 		//                like wireshark.
 		//     "desc": a string with a description of the field
+		//     "addOutput": (optional) if true, suggest this field to be appended to the
+		//				  output string for compatible event sources.
 		// Example return value:
 		// [
-		//    {"type": "uint64", "name": "field1", "desc": "Describing field 1"},
+		//    {"type": "uint64", "name": "field1", "desc": "Describing field 1", "addOutput": true},
 		//    {"type": "string", "name": "field2", "arg": {"isRequired": true, "isIndex": true},
 		//    "desc": "Describing field 2"},
 		// ]