vrl 0.32.0

Vector Remap Language
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

use super::grammar;

/// Default fields that represent the search path when a Datadog tag/facet is not provided.
static DEFAULT_FIELDS: &[&str] = &[
    "message",
    "custom.error.message",
    "custom.error.stack",
    "custom.title",
    "_default_",
];

/// Attributes that represent special fields in Datadog.
static RESERVED_ATTRIBUTES: &[&str] = &[
    "host",
    "source",
    "status",
    "service",
    "trace_id",
    "message",
    "timestamp",
    "tags",
];

/// Describes a field to search on.
#[derive(Clone, Hash, PartialEq, Eq, Debug)]
pub enum Field {
    /// Default field (when tag/facet isn't provided)
    Default(String),

    // TODO investigate making this be an enum which may make more sense
    //      when dealing with a fixed set of field names
    /// Reserved field that receives special treatment in Datadog.
    Reserved(String),

    /// An Attribute-- i.e. started with `@`.
    // In Datadog Log Search the `@` prefix is used to define a Facet for
    // attribute searching, and the event structure is assumed to have a
    // root level field "custom". In VRL we do not guarantee this event
    // structure so we are diverging a little from the DD Log Search
    // definition and implementation a bit here, by calling this "Attribute".
    //
    // Internally when we handle this enum variant, we attempt to parse the
    // string as a log path to obtain the value.
    Attribute(String),

    /// Tag type - i.e. search in the `tags` field.
    Tag(String),
}

impl Field {
    pub fn as_str(&self) -> &str {
        match self {
            Self::Default(s) => s,
            Self::Reserved(s) => s,
            Self::Attribute(s) => s,
            Self::Tag(s) => s,
        }
    }
}

/// Converts a field/facet name to the VRL equivalent. Datadog payloads have a `message` field
/// (which is used whenever the default field is encountered.
pub fn normalize_fields<T: AsRef<str>>(value: T) -> Vec<Field> {
    let value = value.as_ref();
    if value.eq(grammar::DEFAULT_FIELD) {
        return DEFAULT_FIELDS
            .iter()
            .map(|s| Field::Default((*s).to_owned()))
            .collect();
    }

    let field = match value.replace('@', ".") {
        v if value.starts_with('@') => Field::Attribute(v),
        v if DEFAULT_FIELDS.contains(&v.as_ref()) => Field::Default(v),
        v if RESERVED_ATTRIBUTES.contains(&v.as_ref()) => Field::Reserved(v),
        v => Field::Tag(v),
    };

    vec![field]
}