vector icon indicating copy to clipboard operation
vector copied to clipboard

reduce not worked

Open morgoved opened this issue 1 year ago • 1 comments

A note for the community

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

i have this logs into pod

2024-02-18 14:00:22 UTC [203]: [53-1] 65d20d76.cb 0 brain postgres psql [local] LOG: statement: CREATE OR REPLACE VIEW pg_stat_statements AS SELECT * FROM pg_stat_statements(true); 152 CREATE VIEW 151 2024-02-18 14:00:22 UTC [203]: [54-1] 65d20d76.cb 0 brain postgres psql [local] LOG: statement: CREATE OR REPLACE FUNCTION get_nearly_exhausted_sequences( 150 IN threshold float, 149 OUT schemaname name, 148 OUT sequencename name, 147 OUT seq_percent_used numeric 146 ) RETURNS SETOF record AS 145 $$ 144 SELECT * 143 FROM ( 142 SELECT 141 schemaname, 140 sequencename, 139 round(abs( 138 ceil((abs(last_value::numeric - start_value) + 1) / increment_by) / 137 floor((CASE WHEN increment_by > 0 136 THEN (max_value::numeric - start_value) 135 ELSE (start_value::numeric - min_value) 134 END + 1) / increment_by 133 ) * 100 132 ), 131 2) AS seq_percent_used 130 FROM pg_sequences 129 WHERE NOT CYCLE AND last_value IS NOT NULL 128 ) AS s 127 WHERE seq_percent_used >= threshold; 126 $$ 125 LANGUAGE sql SECURITY DEFINER STRICT SET search_path to 'pg_catalog'; 124 CREATE FUNCTION 123 2024-02-18 14:00:22 UTC [203]: [55-1] 65d20d76.cb 0 brain postgres psql [local] LOG: statement: CREATE OR REPLACE VIEW nearly_exhausted_sequences AS SELECT * FROM get_nearly_exhausted_sequences(0.8); 122 CREATE VIEW 121 2024-02-18 14:00:22 UTC [203]: [56-1] 65d20d76.cb 0 brain postgres psql [local] LOG: statement: REVOKE ALL ON ALL TABLES IN SCHEMA metric_helpers FROM public; 120 REVOKE 119 2024-02-18 14:00:22 UTC [203]: [57-1] 65d20d76.cb 0 brain postgres psql [local] LOG: statement: GRANT SELECT ON ALL TABLES IN SCHEMA metric_helpers TO admin, robot_zmon; 118 GRANT 117 2024-02-18 14:00:22 UTC [203]: [58-1] 65d20d76.cb 0 brain postgres psql [local] LOG: statement: REVOKE ALL ON ALL FUNCTIONS IN SCHEMA metric_helpers FROM public; 116 REVOKE 115 2024-02-18 14:00:22 UTC [203]: [59-1] 65d20d76.cb 0 brain postgres psql [local] LOG: statement: GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA metric_helpers TO admin, robot_zmon; 114 GRANT 113 RESET 112 2024-02-18 14:00:22 UTC [203]: [60-1] 65d20d76.cb 0 brain postgres psql [local] LOG: disconnection: session time: 0:00:00.236 user=postgres database=brain host=[local]

and try to reduce for get one message

but into output not see any changes

Configuration

customConfig:
          data_dir: /vector-data-dir
          sources:
            kubernetes_logs_spilo:
              type: kubernetes_logs
              extra_label_selector: "application=spilo"
          transforms:
            spilo:
              type: "remap"
              inputs:
                - kubernetes_logs_spilo
              source: |
                if contains!(.message, "no action. I am") {
                abort
                }
            spilo_reduce:
              type: "reduce"
              inputs:
                - spilo
              starts_when:
                message:
                  regex: '\d{4}-\d{2}-\d{2}'
                type: is_log
            console:
              type: console
              inputs:
              - spilo_reduce
              encoding:
                codec: raw_message

Version

0.30.2

Debug Output

No response

Example Data

No response

Additional Context

No response

References

No response

morgoved avatar Feb 18 '24 14:02 morgoved

i followed to this

https://vector.dev/highlights/2021-02-16-reduce-transform-remap-support/

and not see this into documentation

morgoved avatar Feb 18 '24 14:02 morgoved

Hi @morgoved ,

I didn't look at this in detail, but type: is_log is wrong. It should be type: vrl (the default).

jszwedko avatar Feb 20 '24 16:02 jszwedko

Closing since I I think my last comment is correct.

jszwedko avatar Jun 13 '24 21:06 jszwedko