github.com/observiq/bindplane-agent@v1.51.0/internal/report/snapshot/filter_logs.go (about) 1 // Copyright observIQ, Inc. 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 package snapshot 16 17 import ( 18 "time" 19 20 "go.opentelemetry.io/collector/pdata/pcommon" 21 "go.opentelemetry.io/collector/pdata/plog" 22 ) 23 24 // filterLogs filters the logs by the given query and timestamp. 25 // The returned payload cannot be assumed to be a copy, so it should not be modified. 26 func filterLogs(logs plog.Logs, searchQuery *string, minimumTimestamp *time.Time) plog.Logs { 27 // No filters specified, filtered logs are trivially the same as input logs 28 if searchQuery == nil && minimumTimestamp == nil { 29 return logs 30 } 31 32 filteredLogs := plog.NewLogs() 33 34 resourceLogs := logs.ResourceLogs() 35 for i := 0; i < resourceLogs.Len(); i++ { 36 filteredResourceLogs := filterResourceLogs(resourceLogs.At(i), searchQuery, minimumTimestamp) 37 38 // Don't append empty resource logs 39 if filteredResourceLogs.ScopeLogs().Len() != 0 { 40 filteredResourceLogs.MoveTo(filteredLogs.ResourceLogs().AppendEmpty()) 41 } 42 } 43 44 return filteredLogs 45 } 46 47 func filterResourceLogs(resourceLog plog.ResourceLogs, searchQuery *string, minimumTimestamp *time.Time) plog.ResourceLogs { 48 filteredResourceLogs := plog.NewResourceLogs() 49 50 // Copy old resource to filtered resource 51 resource := resourceLog.Resource() 52 resource.CopyTo(filteredResourceLogs.Resource()) 53 54 // Apply query to resource 55 queryMatchesResource := true // default to true if no query specified 56 if searchQuery != nil { 57 queryMatchesResource = queryMatchesMap(resource.Attributes(), *searchQuery) 58 } 59 60 scopeLogs := resourceLog.ScopeLogs() 61 for i := 0; i < scopeLogs.Len(); i++ { 62 filteredScopeLogs := filterScopeLogs(resourceLog.ScopeLogs().At(i), queryMatchesResource, searchQuery, minimumTimestamp) 63 64 // Don't append empty scope logs 65 if filteredScopeLogs.LogRecords().Len() != 0 { 66 filteredScopeLogs.MoveTo(filteredResourceLogs.ScopeLogs().AppendEmpty()) 67 } 68 } 69 70 return filteredResourceLogs 71 } 72 73 // filterScopeLogs filters out logs that do not match the query and minimumTimestamp, returning a new plog.ScopeLogs without the filtered records. 74 // queryMatchesResource indicates if the query string matches the resource associated with this ScopeLogs. 75 func filterScopeLogs(scopeLogs plog.ScopeLogs, queryMatchesResource bool, searchQuery *string, minimumTimestamp *time.Time) plog.ScopeLogs { 76 filteredLogRecords := plog.NewScopeLogs() 77 logRecords := scopeLogs.LogRecords() 78 for i := 0; i < logRecords.Len(); i++ { 79 log := logRecords.At(i) 80 if logMatches(log, queryMatchesResource, searchQuery, minimumTimestamp) { 81 log.CopyTo(filteredLogRecords.LogRecords().AppendEmpty()) 82 } 83 } 84 85 return filteredLogRecords 86 } 87 88 // logMatches returns true if the query matches either the resource or log record, AND the min timestamp. 89 func logMatches(l plog.LogRecord, queryMatchesResource bool, searchQuery *string, minimumTimestamp *time.Time) bool { 90 queryMatchesLog := true // default to true if no query specified 91 // Skip this check if we already know the query matches the resource 92 if !queryMatchesResource && searchQuery != nil { 93 queryMatchesLog = logMatchesQuery(l, *searchQuery) 94 } 95 96 timestampMatches := true // default to true if no timestamp specified 97 if minimumTimestamp != nil { 98 timestampMatches = logMatchesTimestamp(l, *minimumTimestamp) 99 } 100 101 queryMatches := queryMatchesResource || queryMatchesLog 102 103 return queryMatches && timestampMatches 104 } 105 106 // logMatchesTimestamp determines if the log came after the provided timestamp 107 func logMatchesTimestamp(l plog.LogRecord, minimumTimestamp time.Time) bool { 108 return l.ObservedTimestamp() > pcommon.NewTimestampFromTime(minimumTimestamp) 109 } 110 111 // logMatchesQuery determines if the given log record matches the given query string 112 func logMatchesQuery(l plog.LogRecord, searchQuery string) bool { 113 if queryMatchesMap(l.Attributes(), searchQuery) { 114 return true 115 } 116 117 if queryMatchesValue(l.Body(), searchQuery) { 118 return true 119 } 120 121 return false 122 }