feat: Add CEF encoder

[nabokihms]

trafficstars

Connected to https://github.com/vectordotdev/vector/issues/17332 Implemented according to the guide.

[netlify[bot]]

✅ Deploy Preview for vector-project canceled.

Name	Link
🔨 Latest commit	0446f383794b60ee75a857008cc3b5bcd2957eeb
🔍 Latest deploy log	https://app.netlify.com/sites/vector-project/deploys/64632dc2758ab10008c01326

[netlify[bot]]

✅ Deploy Preview for vrl-playground ready!

Name	Link
🔨 Latest commit	0446f383794b60ee75a857008cc3b5bcd2957eeb
🔍 Latest deploy log	https://app.netlify.com/sites/vrl-playground/deploys/64632dc2fb5418000888008f
😎 Deploy Preview	https://deploy-preview-17389--vrl-playground.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[github-actions[bot]]

Regression Detector Results

Run ID: 16b6b5ff-a6ae-40a2-9e45-d224f06a1f18
Baseline: c6839995e28fd17aefbe440f092046e660d2fd70
Comparison: e0dce38e1a7f8e79d4463041ef403b604c8ed85a
Total vector CPUs: 7

Explanation

A regression test is an integrated performance test for vector in a repeatable rig, with varying configuration for vector. What follows is a statistical summary of a brief vector run for each configuration across SHAs given above. The goal of these tests are to determine quickly if vector performance is changed and to what degree by a pull request.

Because a target's optimization goal performance in each experiment will vary somewhat each time it is run, we can only estimate mean differences in optimization goal relative to the baseline target. We express these differences as a percentage change relative to the baseline target, denoted "Δ mean %". These estimates are made to a precision that balances accuracy and cost control. We represent this precision as a 90.00% confidence interval denoted "Δ mean % CI": there is a 90.00% chance that the true value of "Δ mean %" is in that interval.

We decide whether a change in performance is a "regression" -- a change worth investigating further -- if both of the following two criteria are true:

1. The estimated |Δ mean %| ≥ 5.00%. This criterion intends to answer the question "Does the estimated change in mean optimization goal performance have a meaningful impact on your customers?". We assume that when |Δ mean %| < 5.00%, the impact on your customers is not meaningful. We also assume that a performance change in optimization goal is worth investigating whether it is an increase or decrease, so long as the magnitude of the change is sufficiently large.

2. Zero is not in the 90.00% confidence interval "Δ mean % CI" about "Δ mean %". This statement is equivalent to saying that there is at least a 90.00% chance that the mean difference in optimization goal is not zero. This criterion intends to answer the question, "Is there a statistically significant difference in mean optimization goal performance?". It also means there is no more than a 10.00% chance this criterion reports a statistically significant difference when the true difference in mean optimization goal is zero -- a "false positive". We assume you are willing to accept a 10.00% chance of inaccurately detecting a change in performance when no true difference exists.

The table below, if present, lists those experiments that have experienced a statistically significant change in mean optimization goal performance between baseline and comparison SHAs with 90.00% confidence OR have been detected as newly erratic. Negative values of "Δ mean %" mean that baseline is faster, whereas positive values of "Δ mean %" mean that comparison is faster. Results that do not exhibit more than a ±5.00% change in their mean optimization goal are discarded. An experiment is erratic if its coefficient of variation is greater than 0.1. The abbreviated table will be omitted if no interesting change is observed.

No interesting changes in experiment optimization goals with confidence ≥ 90.00% and |Δ mean %| ≥ 5.00%.

Fine details of change detection per experiment.

experiment	goal	Δ mean %	Δ mean % CI	confidence
datadog_agent_remap_blackhole	ingress throughput	+3.32	[+3.22, +3.43]	100.00%
datadog_agent_remap_blackhole_acks	ingress throughput	+2.27	[+2.17, +2.36]	100.00%
http_text_to_http_json	ingress throughput	+2.01	[+1.94, +2.07]	100.00%
splunk_hec_route_s3	ingress throughput	+0.79	[+0.64, +0.93]	100.00%
syslog_splunk_hec_logs	ingress throughput	+0.38	[+0.30, +0.46]	100.00%
syslog_loki	ingress throughput	+0.24	[+0.16, +0.31]	100.00%
socket_to_socket_blackhole	ingress throughput	+0.20	[+0.16, +0.25]	100.00%
enterprise_http_to_http	ingress throughput	+0.03	[-0.00, +0.06]	74.49%
http_to_http_noack	ingress throughput	+0.01	[-0.04, +0.06]	22.49%
splunk_hec_to_splunk_hec_logs_acks	ingress throughput	-0.00	[-0.06, +0.06]	0.15%
fluent_elasticsearch	ingress throughput	-0.00	[-0.00, +0.00]	47.54%
splunk_hec_indexer_ack_blackhole	ingress throughput	-0.01	[-0.05, +0.03]	26.17%
splunk_hec_to_splunk_hec_logs_noack	ingress throughput	-0.02	[-0.06, +0.03]	41.97%
file_to_blackhole	ingress throughput	-0.03	[-0.09, +0.03]	46.70%
syslog_log2metric_splunk_hec_metrics	ingress throughput	-0.35	[-0.43, -0.26]	100.00%
http_to_http_json	ingress throughput	-0.47	[-0.54, -0.40]	100.00%
http_to_http_acks	ingress throughput	-1.24	[-2.45, -0.03]	81.18%
datadog_agent_remap_datadog_logs_acks	ingress throughput	-1.26	[-1.37, -1.16]	100.00%
datadog_agent_remap_datadog_logs	ingress throughput	-1.50	[-1.59, -1.40]	100.00%
otlp_grpc_to_blackhole	ingress throughput	-2.29	[-2.40, -2.17]	100.00%
syslog_regex_logs2metric_ddmetrics	ingress throughput	-2.33	[-2.54, -2.11]	100.00%
otlp_http_to_blackhole	ingress throughput	-2.88	[-3.04, -2.72]	100.00%
syslog_humio_logs	ingress throughput	-2.92	[-3.00, -2.83]	100.00%
syslog_log2metric_humio_metrics	ingress throughput	-3.08	[-3.18, -2.97]	100.00%

[jszwedko]

Thanks for this @nabokihms ! Just a quick note that the best reviewer for this is on PTO this week, but we'll get this reviewed more thoroughly this upcoming week.

[jszwedko]

Tagging @neuronull here too since it is somewhat akin to the GELF codec.

[github-actions[bot]]

Regression Detector Results

Run ID: 4b8e05b7-a99d-4edb-8e7c-6c956330d469
Baseline: 970318839d5722a3ab40e8276a0ee6982fa798b3
Comparison: b540ef4c30fed648558cf20a77cb3f0d478ec318
Total vector CPUs: 7

Explanation

A regression test is an integrated performance test for vector in a repeatable rig, with varying configuration for vector. What follows is a statistical summary of a brief vector run for each configuration across SHAs given above. The goal of these tests are to determine quickly if vector performance is changed and to what degree by a pull request.

Because a target's optimization goal performance in each experiment will vary somewhat each time it is run, we can only estimate mean differences in optimization goal relative to the baseline target. We express these differences as a percentage change relative to the baseline target, denoted "Δ mean %". These estimates are made to a precision that balances accuracy and cost control. We represent this precision as a 90.00% confidence interval denoted "Δ mean % CI": there is a 90.00% chance that the true value of "Δ mean %" is in that interval.

We decide whether a change in performance is a "regression" -- a change worth investigating further -- if both of the following two criteria are true:

1. The estimated |Δ mean %| ≥ 5.00%. This criterion intends to answer the question "Does the estimated change in mean optimization goal performance have a meaningful impact on your customers?". We assume that when |Δ mean %| < 5.00%, the impact on your customers is not meaningful. We also assume that a performance change in optimization goal is worth investigating whether it is an increase or decrease, so long as the magnitude of the change is sufficiently large.

2. Zero is not in the 90.00% confidence interval "Δ mean % CI" about "Δ mean %". This statement is equivalent to saying that there is at least a 90.00% chance that the mean difference in optimization goal is not zero. This criterion intends to answer the question, "Is there a statistically significant difference in mean optimization goal performance?". It also means there is no more than a 10.00% chance this criterion reports a statistically significant difference when the true difference in mean optimization goal is zero -- a "false positive". We assume you are willing to accept a 10.00% chance of inaccurately detecting a change in performance when no true difference exists.

The table below, if present, lists those experiments that have experienced a statistically significant change in mean optimization goal performance between baseline and comparison SHAs with 90.00% confidence OR have been detected as newly erratic. Negative values of "Δ mean %" mean that baseline is faster, whereas positive values of "Δ mean %" mean that comparison is faster. Results that do not exhibit more than a ±5.00% change in their mean optimization goal are discarded. An experiment is erratic if its coefficient of variation is greater than 0.1. The abbreviated table will be omitted if no interesting change is observed.

No interesting changes in experiment optimization goals with confidence ≥ 90.00% and |Δ mean %| ≥ 5.00%.

Fine details of change detection per experiment.

experiment	goal	Δ mean %	Δ mean % CI	confidence
syslog_humio_logs	ingress throughput	+2.85	[+2.77, +2.94]	100.00%
syslog_log2metric_splunk_hec_metrics	ingress throughput	+2.39	[+2.28, +2.50]	100.00%
splunk_hec_route_s3	ingress throughput	+2.13	[+1.99, +2.27]	100.00%
datadog_agent_remap_datadog_logs	ingress throughput	+0.65	[+0.53, +0.77]	100.00%
syslog_loki	ingress throughput	+0.50	[+0.39, +0.61]	100.00%
socket_to_socket_blackhole	ingress throughput	+0.35	[+0.30, +0.41]	100.00%
http_text_to_http_json	ingress throughput	+0.31	[+0.23, +0.39]	100.00%
http_to_http_json	ingress throughput	+0.30	[+0.25, +0.35]	100.00%
otlp_http_to_blackhole	ingress throughput	+0.28	[+0.10, +0.47]	94.56%
otlp_grpc_to_blackhole	ingress throughput	+0.26	[+0.14, +0.37]	99.57%
file_to_blackhole	ingress throughput	+0.04	[-0.01, +0.09]	69.37%
enterprise_http_to_http	ingress throughput	+0.03	[-0.00, +0.06]	76.17%
http_to_http_noack	ingress throughput	+0.03	[-0.03, +0.08]	48.58%
splunk_hec_indexer_ack_blackhole	ingress throughput	+0.01	[-0.03, +0.05]	28.25%
fluent_elasticsearch	ingress throughput	+0.00	[-0.00, +0.00]	17.63%
splunk_hec_to_splunk_hec_logs_acks	ingress throughput	-0.01	[-0.07, +0.06]	14.86%
splunk_hec_to_splunk_hec_logs_noack	ingress throughput	-0.02	[-0.06, +0.03]	38.84%
datadog_agent_remap_datadog_logs_acks	ingress throughput	-0.15	[-0.26, -0.03]	90.82%
http_to_http_acks	ingress throughput	-0.26	[-1.47, +0.96]	21.33%
syslog_splunk_hec_logs	ingress throughput	-0.49	[-0.56, -0.41]	100.00%
syslog_log2metric_humio_metrics	ingress throughput	-0.67	[-0.78, -0.56]	100.00%
datadog_agent_remap_blackhole	ingress throughput	-0.93	[-1.05, -0.82]	100.00%
syslog_regex_logs2metric_ddmetrics	ingress throughput	-2.51	[-2.84, -2.19]	100.00%
datadog_agent_remap_blackhole_acks	ingress throughput	-3.09	[-3.19, -2.98]	100.00%

[github-actions[bot]]

Regression Detector Results

Run ID: 0237d43c-f539-48ac-99de-ca14dac27755
Baseline: 970318839d5722a3ab40e8276a0ee6982fa798b3
Comparison: 72745622ce3da0726fbf672113967df4d29d8a78
Total vector CPUs: 7

Explanation

A regression test is an integrated performance test for vector in a repeatable rig, with varying configuration for vector. What follows is a statistical summary of a brief vector run for each configuration across SHAs given above. The goal of these tests are to determine quickly if vector performance is changed and to what degree by a pull request.

Because a target's optimization goal performance in each experiment will vary somewhat each time it is run, we can only estimate mean differences in optimization goal relative to the baseline target. We express these differences as a percentage change relative to the baseline target, denoted "Δ mean %". These estimates are made to a precision that balances accuracy and cost control. We represent this precision as a 90.00% confidence interval denoted "Δ mean % CI": there is a 90.00% chance that the true value of "Δ mean %" is in that interval.

We decide whether a change in performance is a "regression" -- a change worth investigating further -- if both of the following two criteria are true:

1. The estimated |Δ mean %| ≥ 5.00%. This criterion intends to answer the question "Does the estimated change in mean optimization goal performance have a meaningful impact on your customers?". We assume that when |Δ mean %| < 5.00%, the impact on your customers is not meaningful. We also assume that a performance change in optimization goal is worth investigating whether it is an increase or decrease, so long as the magnitude of the change is sufficiently large.

2. Zero is not in the 90.00% confidence interval "Δ mean % CI" about "Δ mean %". This statement is equivalent to saying that there is at least a 90.00% chance that the mean difference in optimization goal is not zero. This criterion intends to answer the question, "Is there a statistically significant difference in mean optimization goal performance?". It also means there is no more than a 10.00% chance this criterion reports a statistically significant difference when the true difference in mean optimization goal is zero -- a "false positive". We assume you are willing to accept a 10.00% chance of inaccurately detecting a change in performance when no true difference exists.

The table below, if present, lists those experiments that have experienced a statistically significant change in mean optimization goal performance between baseline and comparison SHAs with 90.00% confidence OR have been detected as newly erratic. Negative values of "Δ mean %" mean that baseline is faster, whereas positive values of "Δ mean %" mean that comparison is faster. Results that do not exhibit more than a ±5.00% change in their mean optimization goal are discarded. An experiment is erratic if its coefficient of variation is greater than 0.1. The abbreviated table will be omitted if no interesting change is observed.

No interesting changes in experiment optimization goals with confidence ≥ 90.00% and |Δ mean %| ≥ 5.00%.

Fine details of change detection per experiment.

experiment	goal	Δ mean %	Δ mean % CI	confidence
datadog_agent_remap_datadog_logs	ingress throughput	+3.47	[+3.37, +3.56]	100.00%
syslog_regex_logs2metric_ddmetrics	ingress throughput	+2.34	[+2.06, +2.63]	100.00%
http_text_to_http_json	ingress throughput	+1.43	[+1.38, +1.49]	100.00%
http_to_http_json	ingress throughput	+1.36	[+1.30, +1.42]	100.00%
syslog_splunk_hec_logs	ingress throughput	+1.30	[+1.23, +1.38]	100.00%
otlp_http_to_blackhole	ingress throughput	+0.88	[+0.70, +1.07]	100.00%
syslog_humio_logs	ingress throughput	+0.80	[+0.71, +0.89]	100.00%
syslog_log2metric_splunk_hec_metrics	ingress throughput	+0.61	[+0.52, +0.70]	100.00%
datadog_agent_remap_datadog_logs_acks	ingress throughput	+0.59	[+0.47, +0.70]	100.00%
splunk_hec_route_s3	ingress throughput	+0.38	[+0.25, +0.52]	99.98%
syslog_loki	ingress throughput	+0.28	[+0.17, +0.38]	99.93%
http_to_http_acks	ingress throughput	+0.26	[-0.96, +1.48]	21.19%
file_to_blackhole	ingress throughput	+0.05	[-0.00, +0.10]	79.18%
enterprise_http_to_http	ingress throughput	+0.03	[-0.01, +0.07]	67.99%
http_to_http_noack	ingress throughput	+0.03	[-0.03, +0.09]	47.85%
splunk_hec_to_splunk_hec_logs_acks	ingress throughput	+0.00	[-0.06, +0.07]	2.01%
fluent_elasticsearch	ingress throughput	-0.00	[-0.00, +0.00]	4.33%
splunk_hec_indexer_ack_blackhole	ingress throughput	-0.00	[-0.04, +0.04]	1.23%
splunk_hec_to_splunk_hec_logs_noack	ingress throughput	-0.01	[-0.06, +0.03]	28.74%
otlp_grpc_to_blackhole	ingress throughput	-0.08	[-0.19, +0.02]	69.99%
datadog_agent_remap_blackhole	ingress throughput	-0.89	[-1.02, -0.75]	100.00%
socket_to_socket_blackhole	ingress throughput	-0.92	[-0.99, -0.85]	100.00%
syslog_log2metric_humio_metrics	ingress throughput	-2.21	[-2.31, -2.11]	100.00%
datadog_agent_remap_blackhole_acks	ingress throughput	-3.82	[-3.94, -3.70]	100.00%

[github-actions[bot]]

Regression Detector Results

Run ID: e86c3f6b-86b0-4f11-b003-86edecbe6b20
Baseline: 6088abdf6b956940fee4ee827eefb9dce3e84a43
Comparison: 0446f383794b60ee75a857008cc3b5bcd2957eeb
Total vector CPUs: 7

Explanation

A regression test is an integrated performance test for vector in a repeatable rig, with varying configuration for vector. What follows is a statistical summary of a brief vector run for each configuration across SHAs given above. The goal of these tests are to determine quickly if vector performance is changed and to what degree by a pull request.

Because a target's optimization goal performance in each experiment will vary somewhat each time it is run, we can only estimate mean differences in optimization goal relative to the baseline target. We express these differences as a percentage change relative to the baseline target, denoted "Δ mean %". These estimates are made to a precision that balances accuracy and cost control. We represent this precision as a 90.00% confidence interval denoted "Δ mean % CI": there is a 90.00% chance that the true value of "Δ mean %" is in that interval.

We decide whether a change in performance is a "regression" -- a change worth investigating further -- if both of the following two criteria are true:

1. The estimated |Δ mean %| ≥ 5.00%. This criterion intends to answer the question "Does the estimated change in mean optimization goal performance have a meaningful impact on your customers?". We assume that when |Δ mean %| < 5.00%, the impact on your customers is not meaningful. We also assume that a performance change in optimization goal is worth investigating whether it is an increase or decrease, so long as the magnitude of the change is sufficiently large.

2. Zero is not in the 90.00% confidence interval "Δ mean % CI" about "Δ mean %". This statement is equivalent to saying that there is at least a 90.00% chance that the mean difference in optimization goal is not zero. This criterion intends to answer the question, "Is there a statistically significant difference in mean optimization goal performance?". It also means there is no more than a 10.00% chance this criterion reports a statistically significant difference when the true difference in mean optimization goal is zero -- a "false positive". We assume you are willing to accept a 10.00% chance of inaccurately detecting a change in performance when no true difference exists.

The table below, if present, lists those experiments that have experienced a statistically significant change in mean optimization goal performance between baseline and comparison SHAs with 90.00% confidence OR have been detected as newly erratic. Negative values of "Δ mean %" mean that baseline is faster, whereas positive values of "Δ mean %" mean that comparison is faster. Results that do not exhibit more than a ±5.00% change in their mean optimization goal are discarded. An experiment is erratic if its coefficient of variation is greater than 0.1. The abbreviated table will be omitted if no interesting change is observed.

No interesting changes in experiment optimization goals with confidence ≥ 90.00% and |Δ mean %| ≥ 5.00%.

Fine details of change detection per experiment.

experiment	goal	Δ mean %	Δ mean % CI	confidence
datadog_agent_remap_datadog_logs_acks	ingress throughput	+1.80	[+1.71, +1.89]	100.00%
http_text_to_http_json	ingress throughput	+1.80	[+1.74, +1.86]	100.00%
syslog_log2metric_humio_metrics	ingress throughput	+1.56	[+1.47, +1.65]	100.00%
datadog_agent_remap_datadog_logs	ingress throughput	+1.41	[+1.32, +1.50]	100.00%
datadog_agent_remap_blackhole	ingress throughput	+1.07	[+0.99, +1.16]	100.00%
http_to_http_acks	ingress throughput	+0.93	[-0.29, +2.15]	66.93%
splunk_hec_route_s3	ingress throughput	+0.67	[+0.55, +0.80]	100.00%
enterprise_http_to_http	ingress throughput	+0.07	[+0.03, +0.11]	98.20%
syslog_log2metric_splunk_hec_metrics	ingress throughput	+0.06	[-0.01, +0.13]	70.18%
splunk_hec_to_splunk_hec_logs_acks	ingress throughput	+0.00	[-0.06, +0.06]	1.71%
http_to_http_noack	ingress throughput	+0.00	[-0.06, +0.06]	1.31%
fluent_elasticsearch	ingress throughput	-0.00	[-0.00, +0.00]	23.37%
splunk_hec_indexer_ack_blackhole	ingress throughput	-0.00	[-0.04, +0.04]	1.87%
http_to_http_json	ingress throughput	-0.00	[-0.04, +0.04]	6.21%
splunk_hec_to_splunk_hec_logs_noack	ingress throughput	-0.01	[-0.06, +0.03]	30.59%
file_to_blackhole	ingress throughput	-0.01	[-0.07, +0.04]	24.67%
syslog_loki	ingress throughput	-0.74	[-0.80, -0.67]	100.00%
socket_to_socket_blackhole	ingress throughput	-1.02	[-1.07, -0.98]	100.00%
syslog_splunk_hec_logs	ingress throughput	-1.15	[-1.22, -1.08]	100.00%
otlp_grpc_to_blackhole	ingress throughput	-1.54	[-1.65, -1.43]	100.00%
otlp_http_to_blackhole	ingress throughput	-1.86	[-2.02, -1.70]	100.00%
datadog_agent_remap_blackhole_acks	ingress throughput	-2.01	[-2.09, -1.93]	100.00%
syslog_humio_logs	ingress throughput	-2.17	[-2.23, -2.11]	100.00%
syslog_regex_logs2metric_ddmetrics	ingress throughput	-3.78	[-3.99, -3.57]	100.00%

[nabokihms]

@neuronull thanks for reviewing! I'm on PTO this week. All the suggestions will be answered or fixed next week.

[zamazan4ik]

@nabokihms any update on this PR? :)

[Freakachoo]

@nabokihms are there any updates on this PR? If it's possible to finish and merge it would be very cool! The feature is really needed.

[nabokihms]

Thanks, folks. I have rebased patch for this codec so I would like to continue working on merging this.

https://github.com/deckhouse/deckhouse/blob/main/modules/460-log-shipper/images/vector/patches/cef-encoder.patch There is the patch, I will try to update the PR this week.

[nabokihms]

@jszwedko @neuronull I updated the PR and applied fixes according to comments and currently waiting for another round of review 🙏

[pront]

@jszwedko @neuronull I updated the PR and applied fixes according to comments and currently waiting for another round of review 🙏

Hi @nabokihms, thank you!

I will review this PR. It is a big one, so please bear with me while I go through the code :)

[nabokihms]

Answered to the first round of questions. Good suggestions, @pront

[nabokihms]

@pront I removed one TODO, but for other IDK. I think it is not possible to fix at the current state of the vector project, but would be nice to have in the future.

[pront]

Spell checker failed: https://github.com/vectordotdev/vector/actions/runs/11721969450/job/32650529849?pr=17389

[nabokihms]

@pront I tried to fix the error but probably made it worth... Could you please guide me what is the issue? It seems like it is not in my code.

[pront]

@pront I tried to fix the error but probably made it worth... Could you please guide me what is the issue? It seems like it is not in my code.

Sorry, this was broken on master. You can ignore it.

[pront]

@nabokihms can you apply this https://github.com/deckhouse/3p-vector/pull/447?

Or you can manually do:

1. git revert https://github.com/vectordotdev/vector/pull/17389/commits/90de69be7162e4ec2867b889a2ffd6ed0df457bb
2. git merge origin master

[pront]

Sorry for the friction here, but this conflicts with the spell checker fix on master. Please revert the changes to:

• .github/workflows/spelling.yml
• .github/actions/spelling/expect.txt

You can just git checkout origin/master -- .github/actions/spelling/expect.txt .github/workflows/spelling.yml where origin assumes you pull from vectordotdev/vector

[nabokihms]

test-misc / test-misc failed, but it seems like it was not affected by the PR. Just a flake.

[nabokihms]

Thanks to all who worked on this PR.

[pront]

Thanks to all who worked on this PR.

🎉 Thank you @nabokihms!