[confgenerator] Fix Windows Event Log V2 and Raw receivers in Otel Logging.#2219
Conversation
e905b5a to
87147bd
Compare
| "jsonPayload.ProviderName": {CopyFrom: "jsonPayload.provider.name"}, | ||
| "jsonPayload.Qualifiers": {CopyFrom: "jsonPayload.event_id.qualifiers"}, | ||
| "jsonPayload.Keywords": {CopyFrom: "jsonPayload.parsed_xml.Event.System.Keywords"}, | ||
| "jsonPayload.Level": {CopyFrom: "jsonPayload.parsed_xml.Event.System.Level", Type: "integer"}, |
There was a problem hiding this comment.
is MapValues and MapValuesExclusive not needed anymore?
There was a problem hiding this comment.
MapValues or MapValuesExclusive are not required anymore to "correctly" generate the jsonPayload.Level field on "integer format" (which fluent-bit does by default, which we are replicating here).
jsonPayload.parsed_xml.Event.System.Level is already the original integer field (non-rendered, non-human readable format) so there is no mapping needed.
[Explanation]
There are two versions of Level generated in a "Raw XML" windows even log (see tests for examples), one is Event.System.Level (which is an integer from 1 to 4) and Event.RenderedInfo.Level (which is a "human readable" string like "Info"). We used to do this mapping manually, because the OTel windowseventlog receiver exposes only the "human readable" version by default.
There are ways to expose the non-rendered fields (see #2198) in the receiver, but we chose currently to use the original XML to obtain the "non-rendered" fields.
7d38072 to
c18fa4a
Compare
Description
This PR fixes the following fields in the
windows_event_log_v2andwindows_event_log_raw_xmlreceivers to match it's fluent-bit counterpart. Improved the transformation test cases. This is a followup to #2198.Some details :
V2 :
Level,Opcode,TasksandKeywordsnow usesparsed_xml.Event.System.*fields to show non-rendered versions of this fields.Messagenow usesparsed_xml.Event.RenderingInfo.Messageto show non-parsed security messages.ActivityID,RelatedActivityIDandVersionare now exposed by the OTelwindowseventlogreceiver.Raw :
Messagenow usesparsed_xml.Event.RenderingInfo.Messageto show non-parsed security messages.Related issue
b/413406335
How has this been tested?
Checklist: