René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Improve Transformers -\u003e Allow them to interact with parameters that are not in \"kparams\"","articleBody":"Hello !\nFibratus helps me a lot for my current project. However, I've tried using transformers and it seems to only works for editing parameters that are inside the \"kparams\" parameter.\n\nFor example, my Json output is formated like :\n```\n{\n\"seq\": 9714518,\n\"pid\": 4,\n\"tid\": 4128,\n\"cpu\": 1,\n\"name\": \"CreateFile\",\n\"category\": \"file\",\n\"description\": \"Creates or opens a file or I/O device\",\n\"host\": \"DESKTOP-J1PAUV7\",\"timestamp\": \"2025-05-12T16:27:23.8979653+02:00\",\n\"kparams\":\n{\n\"attributes\": \"NORMAL\",\n\"create_disposition\": \"CREATE\",\n\"create_options\": \"SYNCHRONOUS_IO_NONALERT\",\n\"file_name\": \"C:\\\\Windows\\\\system32\\\\Logfiles\\\\WMI\\\\RtBackup\\\\EtwRTNT Kernel Logger.etl\",\n\"file_object\": \"ffffe50c40d059e0\",\n\"irp\": \"ffffe50c3dc7fc48\",\n\"share_mask\": \"READ|DELETE\",\n\"status\": \"Success\",\n\"tid\": 4128,\n\"type\": \"File\"\n},\n\"meta\": {},\n\"ps\":\n{\n\"pid\": 4,\n\"ppid\": 0,\n\"name\": \"System\",\n\"cmdline\": \"\",\n\"exe\": \"System\",\n\"cwd\": \"\",\n\"sid\": \"S-1-5-18\",\n\"args\": [],\n\"sessionid\": 4294967295\n}\n}\n```\n\nI managed to remove the \"tid\" event inside the \"kparams\" parameter, but I can't remove the \"tid\" event that is outside it. Is there a way around that ?\n\nIf there isn't, I would like that putting a code like that in the fibratus.yml file would work :\n```\ntransformers:\n  # Remove transformer deletes provided event parameters.\n  remove:\n    # Indicates if the remove transformer is enabled\n    enabled: true\n    field:\n      - tid\n```\n\nWould that be a posibility ?","author":{"url":"https://github.com/cyohg","@type":"Person","name":"cyohg"},"datePublished":"2025-05-19T10:20:29.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":19},"url":"https://github.com/506/fibratus/issues/506"}