fix: Fixes AWSSQSQUEUE synthesis rules #1823
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Relevant information
The AWSSQSQUEUE entity definition included a rule that verified that the telemetry data point was coming from an
eventType
that starts withLog
(to be able to support data partitions such asLog_MyDataPartition
).Nevertheless, logs originated from CloudTrail (this is where SQS logs come from) also include an
eventType
attribute (with valueAwsApiCall
). Because theeventType
attribute is a reserved keyword by NRDB, this attribute is removed after the entity synthesis step in the Logs pipeline. However, the entity synthesis step still observes it witheventType: AwsApiCall
.This PR modifies the existing synthesis rules to not rely on the
eventType
attributes at all. Instead, it verifies thateventSource
issqs.amazonaws.com
(this is the value set by CloudTrail to events originated from SQS) and thateventName
is present. The Logging Pipeline will be the one includingaws.sqs.QueueName
and optionallyentityId
, so if these are present it is basically as saying "if the logs came from the Logging Pipeline".Checklist
identifier
will be unique and valid.