diff --git a/auditd-plugin-clickhouse.cpp b/auditd-plugin-clickhouse.cpp index ba9b1de..655536d 100644 --- a/auditd-plugin-clickhouse.cpp +++ b/auditd-plugin-clickhouse.cpp @@ -107,6 +107,15 @@ void optional_set(T &value, const boost::property_tree::ptree &tree, const char optional_set(value, tree, element_name, &always_true); } +std::string sanitize_column_name(const std::string &name) +{ + auto result = name; + + std::replace(result.begin(), result.end(), '-', '_'); + + return result; +} + void auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type, void *user_data) { CallbackData *callback_data = reinterpret_cast(user_data); @@ -285,7 +294,7 @@ void auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type, voi for (auto column_iter = columns.begin(); column_iter != columns.end(); ++column_iter) { - block.AppendColumn(column_iter->name, column_iter->value); + block.AppendColumn(sanitize_column_name(column_iter->name), column_iter->value); } } @@ -334,7 +343,7 @@ std::string construct_clickhouse_datatype_string(const std::string &name, const clickhouse_type = "Nullable(String)"; } - return name + " " + clickhouse_type; + return sanitize_column_name(name) + " " + clickhouse_type; } int main(int argc, char **argv)