-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(datadog service): support filtering on ddtags and ddsource in datadog search syntax #22281
base: master
Are you sure you want to change the base?
Conversation
cea535a
to
0693abf
Compare
80949e4
to
30251ab
Compare
30251ab
to
2e45fb2
Compare
b366d43
to
921fa55
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @20agbekodo, nice enhancement. Tagged Vlad in case they had more thoughts but 👍 from me.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we might have to rename ddsource
to source
and ddtags
to tags
at the DD agent source, because in general DD search syntax does not recognize ddsource
and ddtags
.
Summary
Enhance the Datadog search syntax on transforms filters: we want some keywords to query on several fields at once (OR condition):
tags
will lookup the fieldstags
andddtags
(previously onlytags
)source
will lookup the fieldssource
andddsource
(previously onlysource
)This is because although we try to stay vendor-agnostic, the DD agent source is widely used and generates the fields
ddtags
andddsource
, which is misleading for Observability Pipelines users.Issue here (Datadog access)
Change Type
Is this a breaking change?
How did you test this PR?
cargo test --package vector --lib -- conditions::datadog_search::test --show-output
passes all the tests.The includes the already existing ones + what was added
Does this PR include user facing changes?
Checklist
make check-all
is a good command to run locally. This check isdefined here. Some of these
checks might not be relevant to your PR. For Rust changes, at the very least you should run:
cargo fmt --all
cargo clippy --workspace --all-targets -- -D warnings
cargo nextest run --workspace
(alternatively, you can runcargo test --all
)Cargo.lock
), pleaserun
dd-rust-license-tool write
to regenerate the license inventory and commit the changes (if any). More details here.References