From 71a8cf0293714d015b0e828963765c6df412bfcc Mon Sep 17 00:00:00 2001 From: JocLRojas Date: Tue, 28 Jul 2026 23:22:06 +0300 Subject: [PATCH] Add actionResult mapping for GCP DNS and HTTP request logs --- filters/google/gcp.yml | 45 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/filters/google/gcp.yml b/filters/google/gcp.yml index 94d8d72c2..46b69fb9b 100644 --- a/filters/google/gcp.yml +++ b/filters/google/gcp.yml @@ -486,6 +486,51 @@ pipeline: value: "failed" where: 'exists("log.protoPayloadMethodName") && greaterThan("log.protoPayloadStatusCode", 0)' + # Adding actionResult for Cloud DNS query logs (dns.googleapis.com). + - add: + function: "string" + params: + key: actionResult + value: "success" + where: '!exists("actionResult") && equals("log.jsonPayloadResponseCode", "NOERROR")' + + - add: + function: "string" + params: + key: actionResult + value: "denied" + where: '!exists("actionResult") && equals("log.jsonPayloadResponseCode", "REFUSED")' + + - add: + function: "string" + params: + key: actionResult + value: "failed" + where: '!exists("actionResult") && exists("log.jsonPayloadResponseCode")' + + # Adding actionResult for plain HTTP request logs (Cloud Run, Load + # Balancer, Cloud Functions, App Engine, etc.). + - add: + function: "string" + params: + key: actionResult + value: "success" + where: 'exists("statusCode") && !exists("actionResult") && lessThan("statusCode", 400)' + + - add: + function: "string" + params: + key: actionResult + value: "denied" + where: 'exists("statusCode") && !exists("actionResult") && oneOf("statusCode", [401, 403])' + + - add: + function: "string" + params: + key: actionResult + value: "failed" + where: 'exists("statusCode") && !exists("actionResult") && greaterOrEqual("statusCode", 400)' + # Adding geolocation to origin.ip - dynamic: plugin: com.utmstack.geolocation