Skip to main content

FPL REST Calls, Grok Parsing and Report Processors (v8.240813)

Sysadmin
Sysadmin
Fluency Sysadmin

FPL gains a generic REST API call, Grok parsing and an entity-info row lookup, and FPL reports move into the platform as a new fpl_report processor type with cron jobs. HEC and webhook sinks can skip TLS verification for endpoints with self-signed certificates. The release rolled out to all instances the week of August 12, 2024.

Changes​

Platform FPL APIs​

  • Platform_REST_Call makes a generic REST API call through a REST API integration.
  • Grok parsing: Platform_Grok_Check, Platform_Grok_Register, Platform_Grok_Parse and Platform_Grok_Add_Pattern parse text with Grok patterns, including the widely used open-source pattern library.
  • Platform_EntityinfoLookupRow(table, key) returns the matching entity info row as a JSON object, or undefined when there is no match.
if !Platform_Grok_Check("default") {
    Platform_Grok_Register("default")
}
let m = Platform_Grok_Parse("default", "%{COMMONAPACHELOG}", `127.0.0.1 - - [23/Apr/2014:22:58:32 +0200] "GET /index.php HTTP/1.1" 404 207`)

See the FPL reference.

FPL​

  • Time values are converted to strings when converted to JSON.
  • Errors raised while a lambda runs show their details.

Platform​

  • New processor type fpl_report, which runs FPL reports inside the platform.
  • Cron jobs.
  • New integrations: AWS API and AWS User.
  • Skip TLS verification. An insecureSkipVerify option on the HEC and webhook sinks lets them deliver to endpoints with self-signed certificates.

LavaDB​

  • A new report API handles up to 2 million events.

EventWatch​

  • In multi-tenant mode, entity info and rule updates take effect at each tenant's next rotation — up to an hour later — rather than on every tenant at once.

Fixes​

  • Fixed a sorting error on Overview Summary.
  • Fixed tenant IDs with extra whitespace.