feat(#19183): add namespace input to chronicle sink

[ChocPanda]

trafficstars

feat(#19183): add namespace input to chronicle sink

[bits-bot]

All committers have signed the CLA.

[ChocPanda]

Apologies, I needed to amend the commit to the correct email address in order to sign the CLA.

[ChocPanda]

Hey @StephenWakely, Can we do both? Templatable namespacing sounds really interesting but I am in the process of deploying vector at the moment and I need this feature with a static namespace.

I'll add the documentation to the changelog this evening

[StephenWakely]

Hey @StephenWakely, Can we do both? Templatable namespacing sounds really interesting but I am in the process of deploying vector at the moment and I need this feature with a static namespace.

I'll add the documentation to the changelog this evening

Yes. If I understand you correctly, a template field will only template the parts of the string delimited with {{..}}. So a field of namespace will render as namespace, but a field of namespace-{{ foo }} and an event of { "foo": 32 } will render as namespace-32.

[StephenWakely]

@ChocPanda

We have this CI error now:

File "changelog.d/19183_chronicle_namespace_support.enhancement.md" contains trailing spaces in some of the lines

Our CI can be annoying sometimes, not gonna lie!

[ChocPanda]

Hey @StephenWakely , I think I resolved the issue, unfortunately I was able to run the check locally to confirm

[StephenWakely]

Hi, the integration test failure is not an issue and can be ignored. The other failure is because our documentation is now out of sync.

Can you run make generate-component-docs and check in the resulting changes? This should get everything back in sync.

[ChocPanda]

Hey @StephenWakely, fixed the docs error

[StephenWakely]

@ChocPanda We are getting some CI failures.

• src/sinks/gcp/chronicle_unstructured.rs needs to be run through rustfmt so it is properly formatted.

• The integration tests are failing with:

thread 'sinks::gcp::chronicle_unstructured::integration_tests::publish_events' panicked at src/sinks/gcp/chronicle_unstructured.rs:666:14:
Extracting pull data failed: reqwest::Error { kind: Decode, source: Error("missing field `namespace`", line: 1, column: 214) }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
test sinks::gcp::chronicle_unstructured::integration_tests::publish_events ... FAILED

The integration tests runs against a container that we set up to emulate Chronicle. It is likely that that error is caused because that server is not expecting the namespace field.

https://github.com/vectordotdev/chronicle-emulator/blob/main/src/data.rs#L18

I will see if I can sort that out in a minute.

[github-actions[bot]]

Regression Detector Results

Run ID: f417771f-3ce4-45b6-a3fe-6f3f52d0e3e5 Baseline: 38f4868a9e35dade00098ff71bf5c3c294c335d0 Comparison: cb8f3def4fb63f9d72582701d5e96cfb2f63eff9 Total CPUs: 7

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

No significant changes in experiment optimization goals

Confidence level: 90.00% Effect size tolerance: |Δ mean %| ≥ 5.00%

There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI
➖	syslog_log2metric_humio_metrics	ingress throughput	+1.65	[+1.55, +1.75]
➖	socket_to_socket_blackhole	ingress throughput	+1.21	[+1.14, +1.28]
➖	otlp_http_to_blackhole	ingress throughput	+0.95	[+0.80, +1.09]
➖	datadog_agent_remap_blackhole_acks	ingress throughput	+0.39	[+0.29, +0.48]
➖	datadog_agent_remap_datadog_logs_acks	ingress throughput	+0.39	[+0.31, +0.47]
➖	fluent_elasticsearch	ingress throughput	+0.27	[-0.21, +0.76]
➖	datadog_agent_remap_datadog_logs	ingress throughput	+0.17	[+0.07, +0.28]
➖	http_to_http_noack	ingress throughput	+0.17	[+0.06, +0.27]
➖	file_to_blackhole	egress throughput	+0.04	[-2.45, +2.53]
➖	http_to_http_json	ingress throughput	+0.03	[-0.04, +0.10]
➖	splunk_hec_to_splunk_hec_logs_acks	ingress throughput	+0.00	[-0.16, +0.16]
➖	splunk_hec_indexer_ack_blackhole	ingress throughput	-0.00	[-0.15, +0.14]
➖	syslog_log2metric_splunk_hec_metrics	ingress throughput	-0.03	[-0.17, +0.11]
➖	splunk_hec_to_splunk_hec_logs_noack	ingress throughput	-0.06	[-0.17, +0.05]
➖	enterprise_http_to_http	ingress throughput	-0.10	[-0.16, -0.04]
➖	datadog_agent_remap_blackhole	ingress throughput	-0.15	[-0.24, -0.06]
➖	http_to_s3	ingress throughput	-0.23	[-0.51, +0.05]
➖	splunk_hec_route_s3	ingress throughput	-0.39	[-0.84, +0.06]
➖	syslog_humio_logs	ingress throughput	-0.64	[-0.73, -0.54]
➖	http_to_http_acks	ingress throughput	-0.81	[-2.16, +0.54]
➖	http_elasticsearch	ingress throughput	-0.91	[-0.97, -0.84]
➖	http_text_to_http_json	ingress throughput	-1.19	[-1.31, -1.06]
➖	otlp_grpc_to_blackhole	ingress throughput	-1.28	[-1.37, -1.19]
➖	syslog_log2metric_tag_cardinality_limit_blackhole	ingress throughput	-1.28	[-1.38, -1.18]
➖	syslog_loki	ingress throughput	-1.31	[-1.38, -1.23]
➖	syslog_splunk_hec_logs	ingress throughput	-1.45	[-1.50, -1.40]
➖	syslog_regex_logs2metric_ddmetrics	ingress throughput	-1.61	[-1.71, -1.50]

Explanation

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

3. Its configuration does not mark it "erratic".