Skip to content

feat(loki.secretfilter): Add sampling for secretfilter entries#5663

Merged
mikefat merged 9 commits into
mainfrom
mgordo/273
Mar 11, 2026
Merged

feat(loki.secretfilter): Add sampling for secretfilter entries#5663
mikefat merged 9 commits into
mainfrom
mgordo/273

Conversation

@mikefat
Copy link
Copy Markdown
Contributor

@mikefat mikefat commented Feb 26, 2026

Brief description of Pull Request

This PR introduces the argument rate for loki.secretfilter to sample which log entries are processed by the secret filter; non-sampled entries are forwarded unchanged.

Pull Request Details

  • rate (optional, float, default 1.0): Sampling rate in [0.0, 1.0]. Fraction of entries that are run through detection/redaction; the rest are passed through unmodified. 1.0 = process all (current behavior).
  • Validation: rate must be in [0.0, 1.0]
  • Sampling uses the same boundary + integer RNG approach as the loki.process sampling stage for consistency.
  • New metric: loki_secretfilter_entries_bypassed_total — count of entries forwarded without processing due to sampling.
  • UT refactor: Due to inconsistencies in how the gitleaks handles config reloads (it uses global variables to track its state with itself and within viper), I've refactored the unit tests so that we can test consistently the cases with custom config file versus default config. This was a long tangent, but the gist is that multiple reloads of the config or extensions to the default config were causing inconsistencies in the tests due to gitleaks using global variables to track state.

PR Checklist

  • Documentation added
  • Tests updated

@mikefat mikefat added the type/docs Docs Squad label across all Grafana Labs repos label Feb 26, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 26, 2026

💻 Deploy preview deleted (feat(loki.secretfilter): Add sampling for secretfilter entries).

@mikefat mikefat marked this pull request as ready for review February 26, 2026 15:53
@mikefat mikefat requested review from a team and clayton-cornell as code owners February 26, 2026 15:53
@kleimkuhler kleimkuhler self-requested a review February 26, 2026 17:01
@kelnage
Copy link
Copy Markdown
Contributor

kelnage commented Feb 26, 2026

Is this two PRs? One to refactor the unit tests, and a second to add the sampling feature?

Comment thread docs/sources/reference/components/loki/loki.secretfilter.md Outdated
@mikefat
Copy link
Copy Markdown
Contributor Author

mikefat commented Feb 26, 2026

Is this two PRs? One to refactor the unit tests, and a second to add the sampling feature?

Good point, thanks for flagging. I refactored the UT first since they could be inconsistent as I explained in the description, and I didn't want to add the sampling first since that would have made the refactor more annoying.
I'm happy to split it in two PRs if you prefer. I can open the refactor PR first and then open the sampling PR targeting the refactor branch

@mikefat mikefat requested a review from kalleep March 4, 2026 14:40
Copy link
Copy Markdown
Contributor

@kalleep kalleep left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, since this shared a lot of similarities with stage.sampling it would be useful if the sampling logic was moved to some shared library, WDYT?

Comment thread internal/component/loki/secretfilter/run_test_cases.go
Comment thread internal/component/loki/secretfilter/secretfilter.go Outdated
@mikefat
Copy link
Copy Markdown
Contributor Author

mikefat commented Mar 10, 2026

Nice, since this shared a lot of similarities with stage.sampling it would be useful if the sampling logic was moved to some shared library, WDYT?

In order to keep the PR small and localized I will create a follow up issue for this and add it after we merge this PR 👍

Comment thread docs/sources/reference/components/loki/loki.secretfilter.md Outdated
Comment thread docs/sources/reference/components/loki/loki.secretfilter.md Outdated
Comment thread docs/sources/reference/components/loki/loki.secretfilter.md Outdated
Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com>
@mikefat mikefat merged commit 9997802 into main Mar 11, 2026
48 checks passed
@mikefat mikefat deleted the mgordo/273 branch March 11, 2026 16:09
mikefat added a commit that referenced this pull request Mar 13, 2026
…ocess stage (#5778)

<!--
  CONTRIBUTORS GUIDE:

https://github.com/grafana/alloy/blob/main/docs/developer/contributing.md

If this is your first PR or you have not contributed in a while, we
recommend
  taking the time to review the guide.

  **NOTE**
Your PR title must adhere to Conventional Commit style. For details on
this,
  check out the Contributors Guide linked above.
-->

### Brief description of Pull Request

Based on a comment
[here](#5663 (review)),
this PR refactors the code used for rate-based sampling and organizes it
into an internal shared library. This cuts on code duplication and
creates one source of truth for logic. This is currently used by
`loki.secretfilter` and `loki.process stage.sampling`.

### Pull Request Details

Changes:

- internal/sampling: New package with Sampler struct. Implements the
same probabilistic sampling as before (Jaeger-style algorithm) using
stdlib only.
- loki.secretfilter: Replaces local sampling (boundary/source,
shouldProcessEntry) with *sampling.Sampler; Validate uses
sampling.ValidateRate.
- loki.process stage.sampling: Replaces local sampling and the
jaeger-client-go dependency with *sampling.Sampler; config validation
uses sampling.ValidateRate. Rate remains a required attribute (no
default).
- Tests: internal/sampling has new unit tests

### Notes to the Reviewer

<!-- Add any relevant notes for the reviewers and testers of this PR.
-->

### PR Checklist

<!-- Remove items that do not apply. For completed items, change [ ] to
[x]. -->

- [x] Tests updated
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Mar 26, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

frozen-due-to-age type/docs Docs Squad label across all Grafana Labs repos

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants