Skip to content

feat(engine): add JSON as output format for --list/--list_events#3803

Merged
poiana merged 3 commits intofalcosecurity:masterfrom
legobrick:json_fields_events_output
Mar 17, 2026
Merged

feat(engine): add JSON as output format for --list/--list_events#3803
poiana merged 3 commits intofalcosecurity:masterfrom
legobrick:json_fields_events_output

Conversation

@legobrick
Copy link
Copy Markdown
Contributor

@legobrick legobrick commented Feb 14, 2026 •
edited
Loading

  • Added support of the JSON format
  • Refactored field and events formatting using the strategy pattern

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it: Implements support for printing fields and events in JSON. This allows processing and storing them to build a more consolidated repository of those, to fuel side-artifacts like documentation, autocompletion and others, being able to support also plugins and being able to better address versioning, by storing a field definition per-version and computing a multi-version field table.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer: follows the work in falcosecurity/libs#2837

Does this PR introduce a user-facing change?: YES

feat(engine): --markdown has been deprecated in favor of --format, adding the support of json as alternative to markdown and string

@poiana poiana requested review from Kaizhe and irozzo-1A February 14, 2026 17:52
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Feb 14, 2026

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

@legobrick legobrick mentioned this pull request Feb 16, 2026
Merged
legobrick
legobrick commented Feb 17, 2026
View reviewed changes
Comment thread userspace/engine/field_formatter.cpp Outdated
Comment thread userspace/engine/field_formatter.h Outdated
Comment thread userspace/falco/app/actions/event_formatter.cpp Outdated
Comment thread userspace/falco/app/actions/event_formatter.h Outdated
Comment thread userspace/falco/output_format.h Outdated
@legobrick legobrick marked this pull request as ready for review February 19, 2026 11:00
@legobrick legobrick force-pushed the json_fields_events_output branch from 2de6a93 to 2a80a17 Compare February 19, 2026 11:01
leogr
leogr reviewed Mar 11, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @legobrick

Thanks for this effort!

First of all, to address the failing CI checks, we need to bump libs. We are doing this on #3799. Let's wait for it, and then rebase, please.

Also, I just found minor issues. Otherwise, SGTM. See my suggestions below.

Finally, the clang-format check is failing on the new code (alignment in field_formatter.h, line wrapping in falco_engine.h, and options.cpp). Please fix it or use the pre-commit hook.

Comment thread userspace/engine/falco_engine.h Outdated
Comment thread userspace/falco/app/actions/event_formatter.h Outdated
Comment thread userspace/falco/app/options.cpp
Comment thread userspace/engine/output_format.h
legobrick and others added 2 commits March 13, 2026 22:38
@legobrick
feat: add JSON as output format for --list/--list_events
9938e50 
- Added support of the JSON format
- Refactored field and events formatting using the strategy pattern

Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
@legobrick
fix(engine) license date
6ae5cc9 
Signed-off-by: Paolo Polidori <polyp91@gmail.com>

Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
@legobrick legobrick force-pushed the json_fields_events_output branch 3 times, most recently from bbfc65e to 38468e7 Compare March 13, 2026 21:52
@legobrick
fix(engine): address PR review comments
7bae6be 
- Move output_format.h from userspace/falco/ to userspace/engine/ to
  fix reverse dependency (engine layer was including from app layer);
  update all include paths accordingly
- Add SPDX-License-Identifier to output_format.h
- Remove leftover m_first_event_in_category field from MarkdownFormatter
  (was set in begin_category() but never read)
- Emit deprecation warning to stderr when --markdown is used

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>
@legobrick legobrick force-pushed the json_fields_events_output branch from 38468e7 to 7bae6be Compare March 13, 2026 21:54
@legobrick
Copy link
Copy Markdown
Contributor Author

legobrick commented Mar 13, 2026

Hey @legobrick

Thanks for this effort!

First of all, to address the failing CI checks, we need to bump libs. We are doing this on #3799. Let's wait for it, and then rebase, please.

Also, I just found minor issues. Otherwise, SGTM. See my suggestions below.

Finally, the clang-format check is failing on the new code (alignment in field_formatter.h, line wrapping in falco_engine.h, and options.cpp). Please fix it or use the pre-commit hook.

Thanks for the review @leogr, comments should be all addressed and the PR has been rebased

@poiana poiana added the lgtm label Mar 16, 2026
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Mar 16, 2026

LGTM label has been added.

DetailsGit tree hash: be9bb656c76c2a0506c731841b869af1bb760bc6

@github-project-automation github-project-automation Bot moved this from Todo to In progress in Falco Roadmap Mar 17, 2026
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Mar 17, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, legobrick, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@leogr
Copy link
Copy Markdown
Member

leogr commented Mar 17, 2026

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

false positive

/hold cancel

@poiana poiana merged commit e0c810c into falcosecurity:master Mar 17, 2026
34 checks passed
@github-project-automation github-project-automation Bot moved this from In progress to Done in Falco Roadmap Mar 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leogr leogr leogr approved these changes

@ekoops ekoops ekoops approved these changes

@irozzo-1A irozzo-1A Awaiting requested review from irozzo-1A

@Kaizhe Kaizhe Awaiting requested review from Kaizhe

Assignees

@leogr leogr

@ekoops ekoops

Labels

approved area/engine dco-signoff: yes kind/feature lgtm release-note size/XXL

Projects

Falco Roadmap
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@legobrick @poiana @leogr @ekoops