GetData Multiple Filter Conditions

[cfildish]

Hello,

I'm currently trying to use the GetData function to extract data from Sysdig into a .csv file, and I wanted to ask if there was a method to incorporate multiple filter conditions into the current functionality? (For example, both kubernetes.namespace.name=’production’ and container.image=’nginx’ must be met). Thanks ahead of time for the insight!

Best,
Chris

[philrz]

@cfildish,

Looks like you noticed the docstring for get_data() and I think it put you on the right path. I just did some quick tests to make sure it works ok for me. In case you didn't already find it, check out examples/get_data_advanced.py as it provides a handy starting point for playing with different filter options. I ran some quick tests to verify that something like what you tried still works. For my own test env, one small delta is that it looks like the image tag is part of the container.image, so replacing line #53 of the example with:

filter = "kubernetes.namespace.name = 'production' and container.image='nginx:latest'"

...got me some data for the nginx container in my K8S Deployment.

If you want to use the friendlier short version of the container name as it might typically be represented in your K8S object, this also worked for me:

filter = "kubernetes.namespace.name = 'production' and container.label.io.kubernetes.container.name='nginx'"

In general I find it's helpful to look at some Explore groupings in the Sysdig Monitor UI and see what labels/values you get in various drill-downs, then plug those into your script.

Hopefully that helps. If there's something more subtle to your situation such that you're still not getting data, perhaps you could post your code that's doing the CSV extract and I could give it a look.

--
Phil