fix(generic): use fieldName so the generic filter actually parses input

[kryonsx]

Summary

The generic filter never parses anything. Its grok pattern uses the key field_name, but go-sdk's Pattern message only has fieldName. The engine loads filter definitions with protojson.UnmarshalOptions{DiscardUnknown: true} (go-sdk plugins/config.go), so the key is silently dropped. The grok step then writes nothing, and the json step fails with "source was not found". Every generic event is stored with only its raw line and one error.

This draft renames the key and guards the json step so that plain text lines no longer add an error.

Built and tested on the latest versions: v11 d2479c1a, go-sdk v1.1.36, and EventProcessor 8a3ade7. That engine revision is the same source as today's eventprocessor:v11.2.14 image and eventprocessor/base:1.1.7.

Predecessor: #2605 (closed, historical context only).

Evidence

• No reachable v11 instance holds generic records. Two instances run the deployed filter, and it is byte-identical to this file, including field_name.
• A small program calling go-sdk's own loader (plugins.GetCfg) shows the behavior:
  • strict decoding rejects field_name;
  • the production path drops it with no error or log line, leaving an empty fieldName;
  • the same file spelled fieldName keeps it.
• With an empty fieldName, the grok plugin writes nothing.

Change (filters/generic/generic.yml, 2.0 → 2.0.1)

• field_name: log.message → fieldName: log.message.
• json step: where: 'startsWith("log.message", "{")'.
  • Only a line that starts like a JSON object is parsed as JSON.
  • This is shipped together with the key fix. On its own, the guard would hide the defect.
  • Maintainers can drop it if they prefer the smallest change.

Validation

• Playground (engine 8a3ade7), 29 fabricated inputs:
  • Unchanged filter: 0 events with log.message, 29 with an error.
  • Fixed filter: 27 with log.message (all non-blank inputs), 12 with parsed keys (every one-line JSON object), and 2 errors (text starting with { that is not JSON, and pretty-printed multi-line JSON).
  • Without the guard, 16 events would carry errors.
• Go test plugins/alerts/generic_filter_test.go:
  • It loads the file with go-sdk's loader and checks fieldName.
  • It evaluates the guard with the SDK CEL evaluator.
  • All three checks fail on the original file.
  • The full plugins/alerts suite passes.

Rule

rules/generic/generic/cross_source_lateral_movement.yml is unchanged. It requires top-level origin.ip and origin.user, which no producer writes for generic input: the json step puts every sender key under log.. So the rule cannot fire on generic input, with or without this fix. Retiring or re-scoping it is a maintainer decision, recorded in the audit.

Deferred

• filters/syslog/syslog-generic.yml:9 has the same field_name key. It will get its own review.
• Multi-line input keeps only the first line.
• Indexing when senders use different types for the same key.

See filters/audits/generic.md.

🤖 Generated with Claude Code