Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: remove content if native processor parse failed #1304

Merged
merged 1 commit into from
Jan 2, 2024
Merged

Conversation

yyuuttaaoo
Copy link
Collaborator

Before, the native processors chose to keep both source key and raw_log if parsing fails and keeping unmatched content is desired. Keeping unmatched content in raw_log is to be compatible with older version.
Keeping unmatched content in the source key is convenient if one want data to fall through the next processor when the previous one fails and such behavior is consistent with the behavior of the Go plugin. However, this could result in a doubling of the data volume. As connecting multiple native parsers or connecting native parsers with Go processors is rare now, after this patch only raw_log will be kept. If one want to process the data that previous native processor fails, raw_log must be configured as the source_key in the next processor.

Before, the native processors chose to keep both source key and
__raw_log__ if parsing fails and keeping unmatched content is desired.
Keeping unmatched content in __raw_log__ is to be compatible with older
version.
Keeping unmatched content in the source key is convenient if one want
data to fall through the next processor when the previous one fails and
such behavior is consistent with the behavior of the Go plugin.
However, this could result in a doubling of the data volume. As
connecting multiple native parsers or connecting native parsers with Go
processors is rare now, after this patch only __raw_log__ will be kept.
If one want to process the data that previous native processor fails,
__raw_log__ must be configured as the source_key in the next processor.
@yyuuttaaoo yyuuttaaoo added the bug Something isn't working label Jan 1, 2024
@yyuuttaaoo yyuuttaaoo added this to the v1.8 milestone Jan 1, 2024
@@ -121,6 +121,8 @@ bool ProcessorParseApsaraNative::ProcessEvent(const StringView& logPath,
mProcParseErrorTotal->Add(1);
++(*mParseFailures);
if (!mDiscardUnmatch) {
sourceEvent.DelContent(mSourceKey);
mProcParseOutSizeBytes->Add(-mSourceKey.size() - buffer.size());
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

为什么还有个负值?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

因为log加到__raw_log__,并且从content key中删除了,删除的部分减掉。

@yyuuttaaoo yyuuttaaoo merged commit 022a9b9 into 1.8 Jan 2, 2024
17 checks passed
@henryzhx8 henryzhx8 deleted the fix/raw_log branch June 21, 2024 08:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants