enhancement(gcp_chronicle sink): Add default fallback logic if log_type template cannot be resolved fo… #22323
Conversation
…r Google Chronicle sink
github-actions
bot
added
the
domain: sinks
ArunPiduguDD
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
changelog.d/changelog.d/add_default_fallback_index_google_chronicle_sink.enhancement.md
Fixed
Show fixed
Hide fixed
ArunPiduguDD
force-pushed
the
add-google-chronicle-unresolved-log-type-template-default-fallback
branch
from
40d8e47 to
25f0f17
Compare
|
Hey @ArunPiduguDD, do you need a review on this? It's marked as a draft but I am getting notifications because you tagged me as a reviewer. Happy to review when it's ready. |
@pront Just marked it as ready for review |
Datadog ReportBranch report: ✅ 0 Failed, 7 Passed, 0 Skipped, 25.49s Total Time |
github-actions
bot
added
the
domain: external docs
changelog.d/add_default_fallback_index_google_chronicle_sink.enhancement.md
Outdated
Show resolved
Hide resolved
| pub struct ChroniclePartitioner(Template, Option<Template>); | ||
| pub struct ChroniclePartitioner { | ||
| log_type: Template, | ||
| template_fallback_log_type: Option<String>, |
There was a problem hiding this comment.
Nit:
| template_fallback_log_type: Option<String>, | |
| fallback_log_type: Option<String>, |
Is this intentionally a String and not a Template?
There was a problem hiding this comment.
Yea, it's the fallback option if the log_type template can't be resolved, similar to this Elasticsearch change
Summary
Similar to changes made for the Elasticsearch and Object Storage sinks
Currently, the Google Chronicle sink has the option to specify an log_type to attach to events. This field supports template syntax, however if the template is not able to be resolved, the default behavior is to drop the event.
Adding an optional field that specifies a default fallback log_type that can be used if there is a template rendering error.
Testing
Tested using Vector pipeline with a Google Chronicle sink