Skip to content

Commit

Permalink
docs: make it clear dropped decisions aren't logged
Browse files Browse the repository at this point in the history
And modernize the Rego examples while at it.

Signed-off-by: Anders Eknert <[email protected]>
  • Loading branch information
anderseknert committed Aug 25, 2023
1 parent 8dcdd7d commit 5d7ff83
Showing 1 changed file with 16 additions and 10 deletions.
26 changes: 16 additions & 10 deletions docs/content/management-decision-logs.md
Original file line number Diff line number Diff line change
Expand Up @@ -258,34 +258,40 @@ to track **remove** vs **upsert** mask operations.

### Drop Decision Logs

Drop rules filters all decisions, which evaluate to `true`, before logging them.
Drop rules filters all decisions from logging where the rule evaluates to `true`.

This rule will drop all requests to the _allow_ rule in the _kafka_ package, that returned _true_:
```live:drop_rule_example/kafka_allow_rule:module:read_only
package system.log
drop {
input.path == "kafka/allow"
input.result == true
import future.keywords.if
drop if {
input.path == "kafka/allow"
input.result == true
}
```

Log only requests for _delete_ and _alter_ operations (Kafka with opa-kafka-authorizer):
Log only requests for _delete_ and _alter_ operations
(Kafka with the [opa-kafka-plugin](https://github.com/StyraInc/opa-kafka-plugin)):

```live:drop_rule_example/log_only_delete_alter_operations:module:read_only
package system.log
import future.keywords.if
import future.keywords.in
drop {
input.path == "kafka/allow"
not input.input.action.operation in {"DELETE", "ALTER"}
drop if {
input.path == "kafka/allow"
not input.input.action.operation in {"DELETE", "ALTER"}
}
```

The name of the drop rules by default is `drop` in the package `system.log`. It can be changed with the configuration property `decision_logs.drop_decision`.
The name of the drop rules by default is `drop` in the package `system.log`. It can be changed with the configuration
property `decision_logs.drop_decision`.
```yaml
decision_logs:
drop_decision: /system/log/drop
drop_decision: /system/log/drop
```

### Rate Limiting Decision Logs
Expand Down

0 comments on commit 5d7ff83

Please sign in to comment.