datadog_search query fails to match for exact integers

[spencergilbert]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

We seem to be incorrectly handling exact matching for integers in our datadog_search query syntax.

An exact match like @http.status_code:200 doesn't seem to work when checked against a structure like {"custom": {"http": {"status_code": 200}}}. A few things to note:

• Negating the query ends up positively matching in this case, [email protected]_code:200 returns true from the query
• Ranged queries work, @http.status_code:[200 to 299]
• Comparison queries work, @http.status_code:>100
• Exact matching with strings work @http.status_code:ok against {"custom": {"http": {"status_code": "ok"}}} returns true

cc @vladimir-dd @leebenson

Configuration

[sources.src]
type = "stdin"
decoding = { codec = "json" }

[transforms.flt]
type = "filter"
inputs = [ "src" ]

[transforms.flt.condition]
type = "datadog_search"
source = "@http.status_code:200"

[sinks.out]
type = "console"
target = "stdout"
inputs = [ "flt" ]
encoding = { codec = "json" }

Version

vector 0.21.0 (x86_64-apple-darwin c1edb89 2022-04-14)

Debug Output

No response

Example Data

echo '{"custom": {"http": {"status_code": 200}}}' | vector -c vector.toml

Additional Context

No response

References

No response

[neuronull]

I have reproduced this locally on the 0.35.0

This particular issue is in Vector itself and not in the DatadogSearch functionality that lives in VRL.

That is, in the src/conditions/datadog_search.rs , somewhere we have a bug with the equals case for integers.