in_winevtlog: Enrich EventData key-value map if enabled - #12082
Conversation
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe winevtlog input adds optional named ChangesWindows EventData mapping
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant winevtlog_read
participant winevtlog_event_template_get
participant get_string_inserts
participant winevtlog_pack_event
winevtlog_read->>winevtlog_event_template_get: retrieve event template
winevtlog_read->>get_string_inserts: render event values
winevtlog_read->>winevtlog_pack_event: pass template and string inserts
winevtlog_pack_event->>winevtlog_pack_event: emit named EventData map
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c7dbd50d8a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
plugins/in_winevtlog/winevtlog.c (1)
731-825: 🚀 Performance & Scalability | 🔵 Trivial | ⚖️ Poor tradeoffMetadata enumeration cost on cache miss + permanent negative caching.
event_template_loadopens publisher metadata and linearly scans every event viaEvtNextEventMetadatauntil it matchesevent_id/version. For providers with large event manifests this is an O(N) walk per unique(provider,event_id,version)on the collector thread. It is bounded by the cache so amortized cost is low, but two points are worth confirming:
- The scan happens synchronously in the read path; a provider with thousands of events will pay a one-time spike on first sight of each event.
- A failed/partial load (
valid == FLB_FALSE) is cached and never retried, so transient metadata unavailability permanently suppresses theEventDatamap for that key until restart.Neither is a blocker; consider a short TTL / re-validation for invalid entries if transient failures are a concern.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/in_winevtlog/winevtlog.c` around lines 731 - 825, Review the cache handling around event_template_load and the code that consumes event_template->valid; failed or partial metadata loads must not be permanently cached. Add a short retry/expiration policy for invalid entries, re-invoking event_template_load after the TTL while retaining successful entries indefinitely, and ensure the retry state is synchronized with existing cache access.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@plugins/in_winevtlog/winevtlog.c`:
- Around line 731-825: Review the cache handling around event_template_load and
the code that consumes event_template->valid; failed or partial metadata loads
must not be permanently cached. Add a short retry/expiration policy for invalid
entries, re-invoking event_template_load after the TTL while retaining
successful entries indefinitely, and ensure the retry state is synchronized with
existing cache access.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 21a4ee60-471e-4be7-9774-9653e6e1a8c6
📒 Files selected for processing (4)
plugins/in_winevtlog/in_winevtlog.cplugins/in_winevtlog/pack.cplugins/in_winevtlog/winevtlog.cplugins/in_winevtlog/winevtlog.h
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
2 participants
In the current implementation, we didn't handle EventData key-value map even if an event template insists there's a structure that contains EventData structure. This can be retrieving via EventTemplate.
Closes #12080.
Enter
[N/A]in the box, if an item is not applicable to your change.Testing
Before we can approve your change; please submit the following in a comment:
Then, we can handle EventData key-value map in each of records.
For example, we'll have as follows:
If this is a change to packaging of containers or native binaries then please confirm it works for all targets.
ok-package-testlabel to test for all targets (requires maintainer to do).Documentation
Backporting
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.
Summary by CodeRabbit
New Features
EventDataas structured maps using template field names.event_template_cache_size), defaulting to 256 entries.Bug Fixes
nullinstead of failing.