unrollprocessor

README

Unroll Processor

This is an experimental processor that will take a log record with slice bodies and expand each element of the slice into its own log record within the slice.

Important Note

This is an experimental processor and is expected that this functionality would eventually be moved to an OTTL function.

Supported pipelines

• Logs

How it works

1. The user configures the unroll processor in their desired logs pipeline
2. Logs that go into this pipeline with a pcommon.Slice body will have each element of that body be expanded into its own log record

Configuration

Field	Type	Default	Description
field	string	body	note: body is currently the only available value for unrolling; making this configuration currently static
recursive	bool	false	whether to recursively unroll body slices of slices

Example configuration

unroll:
    recursive: false

How To

Split a log record into multiple via a delimiter: ","

The following configuration utilizes the transformprocessor to first split the original string body and then the unroll processor can create multiple events

receivers:
  filelog:
    include: [ ./test.txt ]
    start_at: beginning
processors:
  transform:
    log_statements:
      - context: log
        statements:
          - set(body, Split(body, ","))
  unroll:
exporters:
  file:
    path: ./test/output.json
service:
  pipelines:
    logs:
      receivers: [filelog]
      processors: [transform, unroll]
      exporters: [file]

Sample Data

1,2,3

{
  "resourceLogs": [
    {
      "resource": {},
      "scopeLogs": [
        {
          "scope": {},
          "logRecords": [
            {
              "observedTimeUnixNano": "1733240156591852000",
              "body": { "stringValue": "1" },
              "attributes": [
                {
                  "key": "log.file.name",
                  "value": { "stringValue": "test.txt" }
                },
              ],
              "traceId": "",
              "spanId": ""
            },
            {
              "observedTimeUnixNano": "1733240156591852000",
              "body": { "stringValue": "2" },
              "attributes": [
                {
                  "key": "log.file.name",
                  "value": { "stringValue": "test.txt" }
                },
              ],
              "traceId": "",
              "spanId": ""
            },
            {
              "observedTimeUnixNano": "1733240156591852000",
              "body": { "stringValue": "3" },
              "attributes": [
                {
                  "key": "log.file.name",
                  "value": { "stringValue": "test.txt" }
                },
              ],
              "traceId": "",
              "spanId": ""
            }
          ]
        }
      ]
    }
  ]
}

Documentation

Overview

Package unrollprocessor contains the logic to unroll logs from a slice in the body field.

Index

• func NewFactory() processor.Factory
• type Config
  • func (c *Config) Validate() error
• type UnrollField

Functions

func NewFactory

func NewFactory() processor.Factory

NewFactory returns a new factory for the Transform processor.

Types

type Config

type Config struct {
	Field     UnrollField `mapstructure:"field"`
	Recursive bool        `mapstructure:"recursive"`
}

Config is the configuration for the unroll processor.

func (*Config) Validate

func (c *Config) Validate() error

Validate checks the configuration for any issues.

type UnrollField

type UnrollField string

UnrollField is the field to unroll.

const (
	// UnrollFieldBody is the only supported field for unrolling logs.
	UnrollFieldBody UnrollField = "body"
)