A Very Unique Helper: Simplifying API Inventory Analysis

Kubeshark Filtering Language (KFL) is inspired by Wireshark’s display filters. Its primary purpose is to filter network traffic according to specific rules. Instead of searching for the needle in the haystack, it filters out the haystack to reveal the needle. It provides a rich language that uses helpers to define rules to filter traffic.

TL;DR—The new unique helper identifies and displays only the unique combinations of specified attributes. It can help reduce noise and focus your diagnosis.

For instance, using the following will show API calls with distinct combinations of the request path and response status.

unique("request.path", "response.status") 

This helper can further combine with other KFL (Kubeshark Filtering Language) statements to increase focus.

For instance,  using the following will show only API calls with unique combinations of request.path , response.status and request.method from  pods matching the regex front.* .

http and src.name==r"front.*" and unique("request.path", "request.method", "response.status")

‍

Want to give it a try? Use this link to see it live in the live demo site.

‍