Fix event handler types filter when using bulk export API

[kshi36]

Fixes #56099

Manual Tests

Test: types filter works correctly for clients using new bulk export API

• When connected to a storage backend supporting bulk export API (eg. Teleport Cloud, Athena backend), and setting toml configuration file with the following options:
  • Verify types="user.login" filter forwards only user.login events to fluentd audit events endpoint
  • Verify skip-event-types="user.login" filter skips forwarding user.login events to fluentd audit events endpoint
  • Verify skip-session-types="db.session.query" filter skips forwarding db.session.query events to fluentd session events endpoint
  • Verify options above yield same results using both toml config file and CLI arguments

changelog: Fixed bug where event handler types filter is ignored for Teleport clients using Athena storage backend

[zmb3]

Why was this removed?

[kshi36]

The cursor CLI option (and environment variable) do not seem to exist anymore

[r0mant]

Just a small comment in addition to what other people commented on already.

Good job figuring this out @kshi36!

[tigrato]

I’m wondering whether we should do the same logic we do in SearchUnstructuredEvents. In that call, we pass the filter types directly to the auth server as a request parameter. Should we do the same here?
It would improve gRPC API throughput and avoid unnecessary unmarshalling and marshalling of events server side that we’ll ultimately discard anyway.

[kshi36]

In that call, we pass the filter types directly to the auth server as a request parameter. Should we do the same here?

I will take a look into this.

[kshi36]

// ExportUnstructuredEvents exports events from a given event chunk returned by GetEventExportChunks. This API prioritizes
// performance over ordering and filtering, and is intended for bulk export of events.
ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.ExportUnstructuredEventsRequest) stream.Stream[*auditlogpb.ExportEventUnstructured]

Based on the documentation on the usage of the bulk export API, it seems to favor not filtering types within ExportUnstructuredEvents. Shall we proceed with filtering types on the server-side after the API call?

[hugoShaka]

Shall we proceed with filtering types on the server-side after the API call?

I think that your PR is fine. We do have some stretch goal this quarter to improve event export performance. But before spending more time improving the design for performance, we'll need to measure where we spend time, what is slow, and where we can reap gains.

Tiago is right and we can definitely improve the design here but if this provides a marginal 2% speedup in the general case (very likely as few events are usually filtered) while we could achieve a 30% speedup by fixing something else (and there's a lot to fix 🫠 ) this would not be a very efficient usage of our time.

[backport-bot-workflows]

@kshi36 See the table below for backport results.

Branch	Result
branch/v17	Failed
branch/v18	Failed