airbnb/streamalert

[Enhancement] Support custom stream name for firehose

chunyong-lin opened this issue · 0 comments

Background

In the discussion of PR #1191, we brought up to support custom stream name for firehose. Currently, the stream name of firehose for data is autogenerated based on prefix (defined in conf/global.json), and schema name (defined in conf/schemas/*.json or conf/logs.json). In some rare cases the firehose needs to be recreated if the stream name is changed (e.g. rename the schema). With custom stream name support, users can keep the existing firehose without recreate a new one.

We plan to add a new optional field in the configuration field in the log schema. For example,

  "cloudwatch:events": {
    "schema": {
      "account": "string",
      "detail": {},
      "detail-type": "string",
      "id": "string",
      "region": "string",
      "resources": [],
      "source": "string",
      "time": "string",
      "version": "string"
    },
    "parser": "json",
    "configuration": {
      "firehose_stream": "my_best_stream_name"
    }
  }

Desired Change

Support custom stream name for firehose both for alerts and data.