Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(datadog service): support filtering on ddtags and ddsource in datadog search syntax #22281

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

20agbekodo
Copy link

@20agbekodo 20agbekodo commented Jan 22, 2025

Summary

Enhance the Datadog search syntax on transforms filters: we want some keywords to query on several fields at once (OR condition):

  • tags will lookup the fields tags and ddtags (previously only tags)
  • source will lookup the fields source and ddsource (previously only source)
    This is because although we try to stay vendor-agnostic, the DD agent source is widely used and generates the fields ddtags and ddsource, which is misleading for Observability Pipelines users.
    Issue here (Datadog access)

Change Type

  • Bug fix
  • New feature (enhancement)
  • Non-functional (chore, refactoring, docs)
  • Performance

Is this a breaking change?

  • Yes
  • No

How did you test this PR?

cargo test --package vector --lib -- conditions::datadog_search::test --show-output passes all the tests.
The includes the already existing ones + what was added

Does this PR include user facing changes?

  • Yes. Please add a changelog fragment based on our guidelines.
  • No. A maintainer will apply the "no-changelog" label to this PR.

Checklist

  • Please read our Vector contributor resources.
    • make check-all is a good command to run locally. This check is
      defined here. Some of these
      checks might not be relevant to your PR. For Rust changes, at the very least you should run:
      • cargo fmt --all
      • cargo clippy --workspace --all-targets -- -D warnings
      • cargo nextest run --workspace (alternatively, you can run cargo test --all)
  • (Not needed) If this PR introduces changes Vector dependencies (modifies Cargo.lock), please
    run dd-rust-license-tool write to regenerate the license inventory and commit the changes (if any). More details here.

References

@bits-bot
Copy link

bits-bot commented Jan 22, 2025

CLA assistant check
All committers have signed the CLA.

@20agbekodo 20agbekodo force-pushed the josue.agbekodo/OPA-2847-vector-opw-allow-array-lookup-on-ddtags branch 4 times, most recently from cea535a to 0693abf Compare January 23, 2025 13:04
@20agbekodo 20agbekodo changed the title ✨ Support filtering on ddtags in datadog search syntax feat(datadog_search transforms): support filtering on ddtags and ddsource in datadog search syntax Jan 23, 2025
@20agbekodo 20agbekodo changed the title feat(datadog_search transforms): support filtering on ddtags and ddsource in datadog search syntax feat(datadog service): support filtering on ddtags and ddsource in datadog search syntax Jan 23, 2025
@20agbekodo 20agbekodo force-pushed the josue.agbekodo/OPA-2847-vector-opw-allow-array-lookup-on-ddtags branch 2 times, most recently from 80949e4 to 30251ab Compare January 23, 2025 13:40
@20agbekodo 20agbekodo force-pushed the josue.agbekodo/OPA-2847-vector-opw-allow-array-lookup-on-ddtags branch from 30251ab to 2e45fb2 Compare January 23, 2025 13:45
@20agbekodo 20agbekodo marked this pull request as ready for review January 23, 2025 14:14
@20agbekodo 20agbekodo requested a review from a team as a code owner January 23, 2025 14:14
@20agbekodo 20agbekodo force-pushed the josue.agbekodo/OPA-2847-vector-opw-allow-array-lookup-on-ddtags branch from b366d43 to 921fa55 Compare January 23, 2025 15:08
@pront pront requested a review from vladimir-dd January 23, 2025 17:49
Copy link
Member

@pront pront left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @20agbekodo, nice enhancement. Tagged Vlad in case they had more thoughts but 👍 from me.

Copy link
Contributor

@vladimir-dd vladimir-dd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we might have to rename ddsource to source and ddtags to tags at the DD agent source, because in general DD search syntax does not recognize ddsource and ddtags.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants