From bff7d5e2b1a822da116fd42538c8e5a98b02b3e3 Mon Sep 17 00:00:00 2001
From: Nancy Enos <nicymimz@gmail.com>
Date: Sat, 26 Oct 2024 23:36:17 +0300
Subject: [PATCH] createst: Allow to exclude certain fields

Ticket: #4062
---
 README.md   |  2 ++
 createst.py | 19 +++++++++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index f11ac3fa6..804f691e5 100644
--- a/README.md
+++ b/README.md
@@ -237,6 +237,8 @@ options:
                         Adds a suricata.yaml to the test
   --features <features>
                         Adds specified features
+  --exclude-fields [EXCLUDE_FIELDS]
+                        Exclude specified fields from filter block
 ```
 
 ### Examples
diff --git a/createst.py b/createst.py
index aac1a9c4a..dd79a6ad3 100755
--- a/createst.py
+++ b/createst.py
@@ -226,17 +226,30 @@ def get_manipulated_list():
     mentioned in `skip_fields` variable.
     """
     eve_path = os.path.join(test_dir, "output", "eve.json")
+    exclude_fields = args["exclude_fields"].strip().split(",") if args["exclude_fields"] else []
     allow_events = args["allow_events"].strip().split(",") if args["allow_events"] else []
+
+    def exclude_nested_fields(data, base_key=""):
+        if isinstance(data, dict):
+            filtered_data = {}
+            for k, v in data.items():
+                full_key = f"{base_key}.{k}" if base_key else k
+                if not any(full_key == excl or full_key.startswith(f"{excl}.") for excl in exclude_fields):
+                    filtered_data[k] = exclude_nested_fields(v, full_key)
+            return filtered_data
+        return data
+
     with open(eve_path, "r") as fp:
         content = fp.read()
     content_list = content.strip().split("\n")
     jcontent_list = [json.loads(e) for e in content_list]
     all_content_list = []
     for e in jcontent_list:
-        md = {k: v for k, v in e.items() if k not in skip_fields}
+        md = exclude_nested_fields(e)
+        
         if "event_type" in md and md["event_type"] == "stats":
             continue
-        all_content_list.append(md)
+        all_content_list.append(md) 
     if allow_events:
         def_eve_content_list = [item for item in all_content_list if item["event_type"] in allow_events]
         if not def_eve_content_list:
@@ -393,6 +406,8 @@ def parse_args():
                         help="Adds a suricata.yaml to the test")
     parser.add_argument("--features", default=None, metavar="<features>",
                         help="Adds specified features")
+    parser.add_argument("--exclude-fields", nargs="?", default=None,
+                        help="Exclude specified fields from filter block")                   
     # add arg to allow stdout only
     args = parser.parse_args()