refactor(flags)!: extract sort-events from options

Author: josedonizetti

deploy/helm/tracee/templates/tracee-config.yaml

@@ -151,7 +151,7 @@ data:
             stack-addresses: {{ .Values.config.output.options.stackAddresses }}
             exec-env: {{ .Values.config.output.options.execEnv }}
             exec-hash: {{ .Values.config.output.options.execHash }}
-            sort-events: {{ .Values.config.output.options.sortEvents }}
+        sort-events: {{ .Values.config.output.sortEvents }}
         {{- with .Values.config.output.webhook }}
         webhook:
             - {{ .name | default "webhook1" }}:

deploy/helm/tracee/values.yaml

@@ -133,7 +133,7 @@ config:
       stackAddresses: false
       execEnv: false
       execHash: dev-inode
-      sortEvents: false
+    sortEvents: false
     # uncomment config.output.webhook to enable a single webhook
     # to configure multiple webhooks, use the configFile field
     # webhook:

deploy/kubernetes/tracee/tracee.yaml

@@ -59,7 +59,7 @@ data:
             stack-addresses: false
             exec-env: false
             exec-hash: dev-inode
-            sort-events: false
+        sort-events: false
 ---
 # Source: tracee/templates/role.yaml
 apiVersion: rbac.authorization.k8s.io/v1

docs/docs/flags/output.1.md

@@ -11,7 +11,7 @@ tracee **\-\-output** - Control how and where output is printed
 
 ## SYNOPSIS
 
-tracee **\-\-output** destinations.*name*.*field*=*value* | option:{stack-addresses,exec-env,exec-hash[={inode,dev-inode,digest-inode}],parse-arguments,parse-arguments-fds,sort-events}
+tracee **\-\-output** destinations.*name*.*field*=*value* | option:{stack-addresses,exec-env,exec-hash[={inode,dev-inode,digest-inode}],parse-arguments,parse-arguments-fds} | sort-events
 
 
 ## DESCRIPTION
@@ -37,7 +37,7 @@ Output destinations are configured using the format: `--output destinations.<nam
 
 ### Output Options
 
-- **option:{stack-addresses,exec-env,exec-hash,parse-arguments,parse-arguments-fds,sort-events}**: Augment output according to the given options. Multiple options can be specified, separated by commas.
+- **option:{stack-addresses,exec-env,exec-hash,parse-arguments,parse-arguments-fds}**: Augment output according to the given options. Multiple options can be specified, separated by commas.
 
   - **stack-addresses**: Include stack memory addresses for each event.
   - **exec-env**: When tracing execve/execveat, show the environment variables that were used for execution.
@@ -48,7 +48,8 @@ Output destinations are configured using the format: `--output destinations.<nam
     - **digest-inode**: Most efficient, keys hash to container image digest and inode pair. Requires container enrichment.
   - **parse-arguments**: Parse event arguments into human-readable strings instead of raw machine-readable values.
   - **parse-arguments-fds**: Enable parse-arguments and enrich file descriptors with file path translation. May cause pipeline slowdowns.
-  - **sort-events**: Enable sorting events before passing them to output. May decrease overall program efficiency.
+
+- **sort-events**: Enable sorting events before passing them to output. May decrease overall program efficiency.
 
 ## EXAMPLES
 

docs/docs/outputs/output-options.md

@@ -107,13 +107,12 @@ See the [Sorting Events](./sorting-events.md) documentation for details on how t
 **Configuration:**
 ```yaml
 output:
-  options:
-    sort-events: true
+  sort-events: true
 ```
 
 **CLI:**
 ```bash
-tracee --output option:sort-events
+tracee --output sort-events
 ```
 
 ## See Also

docs/docs/outputs/sorting-events.md

@@ -7,15 +7,14 @@ The sorting feature sorts incoming events from the BPF programs chronologically
 Enable event sorting using the `sort-events` option:
 
 ```console
-tracee --output option:sort-events
+tracee --output sort-events
 ```
 
 Or in a configuration file:
 
 ```yaml
 output:
-  options:
-    sort-events: true
+  sort-events: true
 ```
 
 !!! Information

docs/docs/policies/usage/cli.md

@@ -117,7 +117,7 @@ output:
     exec-hash: dev-inode
     parse-arguments: true
     parse-arguments-fds: true
-    sort-events: true
+  sort-events: true
   destinations:
     - name: stdout
       format: json

docs/man/output.1

@@ -6,7 +6,8 @@ tracee \f[B]\-\-output\f[R] \- Control how and where output is printed
 .SS SYNOPSIS
 tracee \f[B]\-\-output\f[R]
 destinations.\f[I]name\f[R].\f[I]field\f[R]=\f[I]value\f[R] |
-option:{stack\-addresses,exec\-env,exec\-hash[={inode,dev\-inode,digest\-inode}],parse\-arguments,parse\-arguments\-fds,sort\-events}
+option:{stack\-addresses,exec\-env,exec\-hash[={inode,dev\-inode,digest\-inode}],parse\-arguments,parse\-arguments\-fds} |
+sort\-events
 .SS DESCRIPTION
 The \f[B]\-\-output\f[R] flag allows you to control how and where the
 output is printed using destinations and output options.
@@ -42,7 +43,7 @@ template format
 protocol
 .SS Output Options
 .IP \[bu] 2
-\f[B]option:{stack\-addresses,exec\-env,exec\-hash,parse\-arguments,parse\-arguments\-fds,sort\-events}\f[R]:
+\f[B]option:{stack\-addresses,exec\-env,exec\-hash,parse\-arguments,parse\-arguments\-fds}\f[R]:
 Augment output according to the given options.
 Multiple options can be specified, separated by commas.
 .RS 2
@@ -81,11 +82,11 @@ strings instead of raw machine\-readable values.
 \f[B]parse\-arguments\-fds\f[R]: Enable parse\-arguments and enrich file
 descriptors with file path translation.
 May cause pipeline slowdowns.
+.RE
 .IP \[bu] 2
 \f[B]sort\-events\f[R]: Enable sorting events before passing them to
 output.
 May decrease overall program efficiency.
-.RE
 .SS EXAMPLES
 .IP \[bu] 2
 To output events as JSON to stdout using a destination named

examples/config/global_config.yaml

@@ -178,7 +178,7 @@ output:
     #     exec-hash: dev-inode     # Options: none, inode, dev-inode, digest-inode
     #     parse-arguments: true
     #     parse-arguments-fds: false
-    #     sort-events: false
+    # sort-events: false
 
 # Signatures directory for custom signatures
 signatures-dir: ""

pkg/cmd/flags/config_test.go

@@ -269,7 +269,7 @@ output:
     - option:exec-hash=dev-inode
     - option:parse-arguments
     - option:parse-arguments-fds
-    - option:sort-events
+    - sort-events
     - table:file1
     - json:file2    
     - gotemplate=template1:file3,file4    
@@ -282,7 +282,7 @@ output:
 				"option:exec-hash=dev-inode",
 				"option:parse-arguments",
 				"option:parse-arguments-fds",
-				"option:sort-events",
+				"sort-events",
 				"table:file1",
 				"json:file2",
 				"gotemplate=template1:file3,file4",