Skip to content

Commit ba7764e

Browse files
constanca-mFiery-Fenix
constanca-m
authored and
Fiery-Fenix
committed
[extension/awslogsencodingextension] VPC flow logs: add support for ECS fields (open-telemetry#39241)
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue. Ex. Adding a feature - Explain what this achieves.--> #### Description Add support for ECS fields. <!--Describe the documentation added.--> #### Documentation README updated.
1 parent d4cb96d commit ba7764e

File tree

3 files changed

+89
-45
lines changed

3 files changed

+89
-45
lines changed

‎.chloggen/vpc-flow-log-add-ecs.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Use this changelog template to create an entry for release notes.
2+
3+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
4+
change_type: enhancement
5+
6+
# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
7+
component: awslogsencodingextension
8+
9+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
10+
note: Add support for ECS fields.
11+
12+
# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
13+
issues: [39241]
14+
15+
# (Optional) One or more lines of additional information to render under the primary note.
16+
# These lines will be padded with 2 spaces and then inserted directly into the document.
17+
# Use pipe (|) for multiline entries.
18+
subtext:
19+
20+
# If your change doesn't affect end users or the exported elements of any package,
21+
# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
22+
# Optional: The change log or logs in which this entry should be included.
23+
# e.g. '[user]' or '[user, api]'
24+
# Include 'user' if the change is relevant to end users.
25+
# Include 'api' if there is a change to a library API.
26+
# Default: '[user]'
27+
change_logs: []

‎extension/encoding/awslogsencodingextension/README.md

+42-44
Original file line numberDiff line numberDiff line change
@@ -44,47 +44,45 @@ extensions:
4444
4545
[VPC flow log record fields](https://docs.aws.amazon.com/vpc/latest/userguide/flow-log-records.html#flow-logs-fields) are mapped this way in the resulting OpenTelemetry log:
4646
47-
| Flow log field | Attribute in OpenTelemetry log | Available? |
48-
|------------------------------|-------------------------------------------------------------------------------------------------------|:------------:|
49-
| `version` | `aws.vpc.flow.log.version` | 🟢 |
50-
| `account-id` | `cloud.account.id` | 🟢 |
51-
| `interface-id` | `network.interface.name` | 🟢 |
52-
| `srcaddr` | `source.address`: if `pkt-srcaddr` not filled or the same <br> `network.peer.address`: otherwise | 🟢 |
53-
| `pkt-srcaddr` | `source.address` if filled | 🟢 |
54-
| `dstaddr` | `destination.address`: if `pkt-dstaddr` not filled or the same <br> `network.peer.address`: otherwise | 🟢 |
55-
| `pkt-dstaddr` | `destination.address` if filled | 🟢 |
56-
| `srcport` | `source.port` | 🟢 |
57-
| `dstport` | `destination.port` | 🟢 |
58-
| `protocol` | `network.protocol.name` | 🟢 |
59-
| `packets` | `aws.vpc.flow.packets` | 🟢 |
60-
| `bytes` | `aws.vpc.flow.bytes` | 🟢 |
61-
| `start` | `aws.vpc.flow.start` | 🟢 |
62-
| `end` | Log timestamp | 🟢 |
63-
| `action` | `aws.vpc.flow.action` | 🟢 |
64-
| `log-status` | `aws.vpc.flow.status` | 🟢 |
65-
| `vpc-id` | `aws.vpc.id` | 🟢 |
66-
| `subnet-id` | `aws.vpc.subnet.id` | 🟢 |
67-
| `instance-id` | `host.id` | 🟢 |
68-
| `tcp-flags` | `network.tcp.flags` | 🟢 |
69-
| `type` | `network.type` | 🟢 |
70-
| `region` | `cloud.region` | 🟢 |
71-
| `az-id` | `aws.az.id` | 🟢 |
72-
| `sublocation-type` | `aws.sublocation.type` | 🟢 |
73-
| `sublocation-id` | `aws.sublocation.id` | 🟢 |
74-
| `pkt-src-aws-service` | `aws.vpc.flow.source.service` | 🟢 |
75-
| `pkt-dst-aws-service` | `aws.vpc.flow.destination.service` | 🟢 |
76-
| `flow-direction` | `network.io.direction` | 🟢 |
77-
| `traffic-path` | `aws.vpc.flow.traffic_path` | 🟢 |
78-
| `ecs-cluster-arn` | `aws.ecs.cluster.arn` | 🔴 |
79-
| `ecs-cluster-name` | `aws.ecs.cluster.name` | 🔴 |
80-
| `ecs-container-instance-arn` | `aws.ecs.container.instance.arn` | 🔴 |
81-
| `ecs-container-instance-id` | `aws.ecs.container.instance.id` | 🔴 |
82-
| `ecs-container-id` | `aws.ecs.container.id` | 🔴 |
83-
| `ecs-second-container-id` | `aws.ecs.second.container.arn` | 🔴 |
84-
| `ecs-service-name` | `aws.ecs.service.name` | 🔴 |
85-
| `ecs-task-definition-arn` | `aws.ecs.task.definition.arn` | 🔴 |
86-
| `ecs-task-arn` | `aws.ecs.task.arn` | 🔴 |
87-
| `ecs-task-id` | `aws.ecs.task.id` | 🔴 |
88-
| `reject-reason` | `aws.vpc.flow.reject_reason` | 🟢 |
89-
90-
47+
| Flow log field | Attribute in OpenTelemetry log |
48+
|------------------------------|-------------------------------------------------------------------------------------------------------|
49+
| `version` | `aws.vpc.flow.log.version` |
50+
| `account-id` | `cloud.account.id` |
51+
| `interface-id` | `network.interface.name` |
52+
| `srcaddr` | `source.address`: if `pkt-srcaddr` not filled or the same <br> `network.peer.address`: otherwise |
53+
| `pkt-srcaddr` | `source.address` if filled |
54+
| `dstaddr` | `destination.address`: if `pkt-dstaddr` not filled or the same <br> `network.peer.address`: otherwise |
55+
| `pkt-dstaddr` | `destination.address` if filled |
56+
| `srcport` | `source.port` |
57+
| `dstport` | `destination.port` |
58+
| `protocol` | `network.protocol.name` |
59+
| `packets` | `aws.vpc.flow.packets` |
60+
| `bytes` | `aws.vpc.flow.bytes` |
61+
| `start` | `aws.vpc.flow.start` |
62+
| `end` | Log timestamp |
63+
| `action` | `aws.vpc.flow.action` |
64+
| `log-status` | `aws.vpc.flow.status` |
65+
| `vpc-id` | `aws.vpc.id` |
66+
| `subnet-id` | `aws.vpc.subnet.id` |
67+
| `instance-id` | `host.id` |
68+
| `tcp-flags` | `network.tcp.flags` |
69+
| `type` | `network.type` |
70+
| `region` | `cloud.region` |
71+
| `az-id` | `aws.az.id` |
72+
| `sublocation-type` | `aws.sublocation.type` |
73+
| `sublocation-id` | `aws.sublocation.id` |
74+
| `pkt-src-aws-service` | `aws.vpc.flow.source.service` |
75+
| `pkt-dst-aws-service` | `aws.vpc.flow.destination.service` |
76+
| `flow-direction` | `network.io.direction` |
77+
| `traffic-path` | `aws.vpc.flow.traffic_path` |
78+
| `ecs-cluster-arn` | `aws.ecs.cluster.arn` |
79+
| `ecs-cluster-name` | `aws.ecs.cluster.name` |
80+
| `ecs-container-instance-arn` | `aws.ecs.container.instance.arn` |
81+
| `ecs-container-instance-id` | `aws.ecs.container.instance.id` |
82+
| `ecs-container-id` | `aws.ecs.container.id` |
83+
| `ecs-second-container-id` | `aws.ecs.second.container.id` |
84+
| `ecs-service-name` | `aws.ecs.service.name` |
85+
| `ecs-task-definition-arn` | `aws.ecs.task.definition.arn` |
86+
| `ecs-task-arn` | `aws.ecs.task.arn` |
87+
| `ecs-task-id` | `aws.ecs.task.id` |
88+
| `reject-reason` | `aws.vpc.flow.reject_reason` |

‎extension/encoding/awslogsencodingextension/internal/unmarshaler/vpc-flow-log/vpc_flow_log_unmarshaler.go

+20-1
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,6 @@ func handleField(
293293
}
294294

295295
switch field {
296-
// TODO Add support for ECS fields
297296
case "srcaddr":
298297
// handled later
299298
addr.source = value
@@ -390,6 +389,26 @@ func handleField(
390389
record.Attributes().PutStr("aws.vpc.flow.destination.service", value)
391390
case "traffic-path":
392391
record.Attributes().PutStr("aws.vpc.flow.traffic_path", value)
392+
case "ecs-cluster-arn":
393+
record.Attributes().PutStr(conventions.AttributeAWSECSClusterARN, value)
394+
case "ecs-cluster-name":
395+
record.Attributes().PutStr("aws.ecs.cluster.name", value)
396+
case "ecs-container-instance-arn":
397+
record.Attributes().PutStr("aws.ecs.container.instance.arn", value)
398+
case "ecs-container-instance-id":
399+
record.Attributes().PutStr("aws.ecs.container.instance.id", value)
400+
case "ecs-container-id":
401+
record.Attributes().PutStr("aws.ecs.container.id", value)
402+
case "ecs-second-container-id":
403+
record.Attributes().PutStr("aws.ecs.second.container.id", value)
404+
case "ecs-service-name":
405+
record.Attributes().PutStr("aws.ecs.service.name", value)
406+
case "ecs-task-definition-arn":
407+
record.Attributes().PutStr("aws.ecs.task.definition.arn", value)
408+
case "ecs-task-arn":
409+
record.Attributes().PutStr(conventions.AttributeAWSECSTaskARN, value)
410+
case "ecs-task-id":
411+
record.Attributes().PutStr(conventions.AttributeAWSECSTaskID, value)
393412
case "reject-reason":
394413
record.Attributes().PutStr("aws.vpc.flow.reject_reason", value)
395414
default:

0 commit comments

Comments
 (0)