mirror of
https://github.com/hyperdxio/hyperdx
synced 2026-04-21 13:37:15 +00:00
4c42fdc3a4
For a log line like
```
x-amz-id-2: WxwS/N175wqLyRlzCXLpGZGszCEbQA0f63uFgdQN1qfcPr2IAmwE/P7HF2b1NdZLg18pNLF3ecTw5CrItXJid/uLe+fxh3jMBiJ7UlUxidw=
```
The level will be inferred as fatal because it contains `CrIt`, which is incorrect.
To fix this, we need to add a word boundary at the start
Ref: HDX-3439
CLAUDE: made a mistake.
```
❌ Test expects "ALERTING" to match "alert" keyword → "ALERTING" won't match with word boundary because "alert" is a substring, not at a word boundary. Expected should be "info",9,"ALERTING system engaged" not "fatal",21.
```
-> incorrect statement
77 lines
3.5 KiB
YAML
77 lines
3.5 KiB
YAML
# Receivers are now configured dynamically in opampController.ts
|
|
processors:
|
|
transform:
|
|
log_statements:
|
|
- context: log
|
|
error_mode: ignore
|
|
statements:
|
|
# JSON parsing: Extends log attributes with the fields from structured log body content, either as an OTEL map or
|
|
# as a string containing JSON content.
|
|
- set(log.cache, ExtractPatterns(log.body, "(?P<0>(\\{.*\\}))")) where IsString(log.body)
|
|
- merge_maps(log.attributes, ParseJSON(log.cache["0"]), "upsert") where IsMap(log.cache)
|
|
- flatten(log.attributes) where IsMap(log.cache)
|
|
- merge_maps(log.attributes, log.body, "upsert") where IsMap(log.body)
|
|
- context: log
|
|
error_mode: ignore
|
|
conditions:
|
|
- severity_number == 0 and severity_text == ""
|
|
statements:
|
|
# Infer: extract the first log level keyword from the first 256 characters of the body
|
|
- set(log.cache["substr"], log.body.string) where Len(log.body.string) < 256
|
|
- set(log.cache["substr"], Substring(log.body.string, 0, 256)) where Len(log.body.string) >= 256
|
|
- set(log.cache, ExtractPatterns(log.cache["substr"], "(?i)(?P<0>\\b(alert|crit|emerg|fatal|error|err|warn|notice|debug|dbug|trace))"))
|
|
# Infer: detect FATAL
|
|
- set(log.severity_number, SEVERITY_NUMBER_FATAL) where IsMatch(log.cache["0"], "(?i)(alert|crit|emerg|fatal)")
|
|
- set(log.severity_text, "fatal") where log.severity_number == SEVERITY_NUMBER_FATAL
|
|
# Infer: detect ERROR
|
|
- set(log.severity_number, SEVERITY_NUMBER_ERROR) where IsMatch(log.cache["0"], "(?i)(error|err)")
|
|
- set(log.severity_text, "error") where log.severity_number == SEVERITY_NUMBER_ERROR
|
|
# Infer: detect WARN
|
|
- set(log.severity_number, SEVERITY_NUMBER_WARN) where IsMatch(log.cache["0"], "(?i)(warn|notice)")
|
|
- set(log.severity_text, "warn") where log.severity_number == SEVERITY_NUMBER_WARN
|
|
# Infer: detect DEBUG
|
|
- set(log.severity_number, SEVERITY_NUMBER_DEBUG) where IsMatch(log.cache["0"], "(?i)(debug|dbug)")
|
|
- set(log.severity_text, "debug") where log.severity_number == SEVERITY_NUMBER_DEBUG
|
|
# Infer: detect TRACE
|
|
- set(log.severity_number, SEVERITY_NUMBER_TRACE) where IsMatch(log.cache["0"], "(?i)(trace)")
|
|
- set(log.severity_text, "trace") where log.severity_number == SEVERITY_NUMBER_TRACE
|
|
# Infer: else
|
|
- set(log.severity_text, "info") where log.severity_number == 0
|
|
- set(log.severity_number, SEVERITY_NUMBER_INFO) where
|
|
log.severity_number == 0
|
|
- context: log
|
|
error_mode: ignore
|
|
statements:
|
|
# Normalize the severity_text case
|
|
- set(log.severity_text, ConvertCase(log.severity_text, "lower"))
|
|
resourcedetection:
|
|
detectors:
|
|
- env
|
|
- system
|
|
- docker
|
|
timeout: 5s
|
|
override: false
|
|
batch:
|
|
memory_limiter:
|
|
# 80% of maximum memory up to 2G
|
|
limit_mib: 1500
|
|
# 25% of limit up to 2G
|
|
spike_limit_mib: 512
|
|
check_interval: 5s
|
|
# Connectors and exporters are now configured dynamically in opampController.ts
|
|
extensions:
|
|
health_check:
|
|
endpoint: :13133
|
|
service:
|
|
telemetry:
|
|
metrics:
|
|
readers:
|
|
- pull:
|
|
exporter:
|
|
prometheus:
|
|
host: '0.0.0.0'
|
|
port: 8888
|
|
logs:
|
|
level: ${HYPERDX_LOG_LEVEL}
|
|
extensions: [health_check]
|
|
# Pipelines are now configured dynamically in opampController.ts
|