vectordotdev
fix(sources): fix unexpected timestamp field
When log namespacing is enabled, exec and http_server sources include a redundant timestamp field when decoding is enabled. When decoding is not enabled, they put the content under a "message" key, instead of directly in the root object.
In the case of exec, the issue was caused by passing a hardcoded LogNamespace value to the decoder. Fixed by passing the parsed value.
In the case of http_server, the decoder ignored the global LogNamespace. Fixed by passing the correctly parsed value to the decoder.
Fixes #20404.
Tested manually with the following config (copied verbatim from #20404):
schema:
log_namespace: true
sources:
source_exec:
type: exec
command: ['echo', '{"log": "123"}']
mode: scheduled
source_http_server:
type: http_server
address: 0.0.0.0:80
source_socket:
type: socket
address: 0.0.0.0:9000
mode: tcp
sinks:
sink_console:
inputs:
- source_*
type: console
encoding:
codec: json
Please double check, though. I'm not a ddog / vector expert, so it won't hurt to be extra careful here.
Regression Detector Results
Run ID: ddbeb5e5-87b6-4762-9a2f-a02b0815e129 Metrics dashboard
Baseline: 96e55620701a9f1150e31319707ce09ea5ee69fb Comparison: 158d5fb1a8741d51f8cb2e7a26ecd85f91902508
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
Significant changes in experiment optimization goals
Confidence level: 90.00% Effect size tolerance: |Δ mean %| ≥ 5.00%
| perf | experiment | goal | Δ mean % | Δ mean % CI | links |
|---|---|---|---|---|---|
| ❌ | syslog_regex_logs2metric_ddmetrics | ingress throughput | -7.41 | [-7.59, -7.23] |
Experiments ignored for regressions
Regressions in experiments with settings containing erratic: true are ignored.
| perf | experiment | goal | Δ mean % | Δ mean % CI | links |
|---|---|---|---|---|---|
| ➖ | file_to_blackhole | egress throughput | -0.78 | [-4.92, +3.36] |
Fine details of change detection per experiment
| perf | experiment | goal | Δ mean % | Δ mean % CI | links |
|---|---|---|---|---|---|
| ➖ | datadog_agent_remap_datadog_logs | ingress throughput | +1.73 | [+1.53, +1.93] | |
| ➖ | datadog_agent_remap_datadog_logs_acks | ingress throughput | +1.21 | [+1.02, +1.40] | |
| ➖ | http_to_s3 | ingress throughput | +0.71 | [+0.56, +0.87] | |
| ➖ | syslog_splunk_hec_logs | ingress throughput | +0.37 | [+0.25, +0.50] | |
| ➖ | splunk_hec_to_splunk_hec_logs_noack | ingress throughput | +0.01 | [-0.02, +0.03] | |
| ➖ | splunk_hec_to_splunk_hec_logs_acks | ingress throughput | +0.00 | [-0.03, +0.03] | |
| ➖ | splunk_hec_indexer_ack_blackhole | ingress throughput | +0.00 | [-0.02, +0.02] | |
| ➖ | http_to_http_noack | ingress throughput | +0.00 | [-0.06, +0.06] | |
| ➖ | http_to_http_json | ingress throughput | -0.01 | [-0.06, +0.04] | |
| ➖ | http_to_http_acks | ingress throughput | -0.03 | [-0.52, +0.46] | |
| ➖ | syslog_log2metric_tag_cardinality_limit_blackhole | ingress throughput | -0.10 | [-0.20, -0.00] | |
| ➖ | fluent_elasticsearch | ingress throughput | -0.37 | [-0.92, +0.17] | |
| ➖ | syslog_log2metric_humio_metrics | ingress throughput | -0.47 | [-0.63, -0.30] | |
| ➖ | syslog_log2metric_splunk_hec_metrics | ingress throughput | -0.48 | [-0.60, -0.36] | |
| ➖ | http_text_to_http_json | ingress throughput | -0.73 | [-0.89, -0.58] | |
| ➖ | file_to_blackhole | egress throughput | -0.78 | [-4.92, +3.36] | |
| ➖ | syslog_loki | ingress throughput | -0.98 | [-1.07, -0.89] | |
| ➖ | socket_to_socket_blackhole | ingress throughput | -1.85 | [-1.92, -1.79] | |
| ➖ | http_elasticsearch | ingress throughput | -2.45 | [-2.65, -2.25] | |
| ➖ | datadog_agent_remap_blackhole_acks | ingress throughput | -2.68 | [-2.78, -2.59] | |
| ➖ | otlp_http_to_blackhole | ingress throughput | -2.80 | [-2.91, -2.68] | |
| ➖ | otlp_grpc_to_blackhole | ingress throughput | -2.91 | [-3.10, -2.71] | |
| ➖ | splunk_hec_route_s3 | ingress throughput | -2.97 | [-3.26, -2.68] | |
| ➖ | datadog_agent_remap_blackhole | ingress throughput | -2.99 | [-3.14, -2.84] | |
| ➖ | syslog_humio_logs | ingress throughput | -3.51 | [-3.61, -3.41] | |
| ❌ | syslog_regex_logs2metric_ddmetrics | ingress throughput | -7.41 | [-7.59, -7.23] |
Explanation
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
Regression Detector Results
Run ID: 6a91f78b-0cd3-4acc-b10a-19b67c8d83dd Metrics dashboard
Baseline: dc441a28bb8dda527e79bbc3e8145bcb5ee0cadf Comparison: f1bdfc09b1c8badff91c3e57438f0c17bc504a84
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
No significant changes in experiment optimization goals
Confidence level: 90.00% Effect size tolerance: |Δ mean %| ≥ 5.00%
There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.
Experiments ignored for regressions
Regressions in experiments with settings containing erratic: true are ignored.
| perf | experiment | goal | Δ mean % | Δ mean % CI | links |
|---|---|---|---|---|---|
| ➖ | file_to_blackhole | egress throughput | -2.21 | [-6.34, +1.92] |
Fine details of change detection per experiment
| perf | experiment | goal | Δ mean % | Δ mean % CI | links |
|---|---|---|---|---|---|
| ➖ | syslog_log2metric_tag_cardinality_limit_blackhole | ingress throughput | +3.13 | [+2.99, +3.26] | |
| ➖ | syslog_log2metric_humio_metrics | ingress throughput | +2.89 | [+2.75, +3.04] | |
| ➖ | otlp_grpc_to_blackhole | ingress throughput | +2.33 | [+2.13, +2.53] | |
| ➖ | datadog_agent_remap_blackhole_acks | ingress throughput | +2.30 | [+2.18, +2.42] | |
| ➖ | datadog_agent_remap_datadog_logs | ingress throughput | +1.61 | [+1.40, +1.81] | |
| ➖ | http_to_s3 | ingress throughput | +1.45 | [+1.26, +1.64] | |
| ➖ | syslog_log2metric_splunk_hec_metrics | ingress throughput | +1.38 | [+1.24, +1.52] | |
| ➖ | http_text_to_http_json | ingress throughput | +1.36 | [+1.25, +1.47] | |
| ➖ | http_elasticsearch | ingress throughput | +1.04 | [+0.87, +1.21] | |
| ➖ | syslog_humio_logs | ingress throughput | +0.84 | [+0.66, +1.02] | |
| ➖ | syslog_loki | ingress throughput | +0.65 | [+0.50, +0.79] | |
| ➖ | syslog_splunk_hec_logs | ingress throughput | +0.60 | [+0.48, +0.71] | |
| ➖ | datadog_agent_remap_blackhole | ingress throughput | +0.37 | [+0.26, +0.48] | |
| ➖ | splunk_hec_to_splunk_hec_logs_acks | ingress throughput | +0.17 | [+0.13, +0.22] | |
| ➖ | fluent_elasticsearch | ingress throughput | +0.13 | [-0.40, +0.67] | |
| ➖ | http_to_http_noack | ingress throughput | +0.01 | [-0.04, +0.07] | |
| ➖ | http_to_http_json | ingress throughput | +0.00 | [-0.04, +0.05] | |
| ➖ | splunk_hec_to_splunk_hec_logs_noack | ingress throughput | +0.00 | [-0.02, +0.02] | |
| ➖ | splunk_hec_indexer_ack_blackhole | ingress throughput | -0.00 | [-0.02, +0.02] | |
| ➖ | http_to_http_acks | ingress throughput | -0.02 | [-0.50, +0.47] | |
| ➖ | otlp_http_to_blackhole | ingress throughput | -0.37 | [-0.48, -0.25] | |
| ➖ | splunk_hec_route_s3 | ingress throughput | -0.63 | [-0.93, -0.32] | |
| ➖ | syslog_regex_logs2metric_ddmetrics | ingress throughput | -0.73 | [-0.88, -0.58] | |
| ➖ | datadog_agent_remap_datadog_logs_acks | ingress throughput | -1.25 | [-1.45, -1.05] | |
| ➖ | socket_to_socket_blackhole | ingress throughput | -1.65 | [-1.73, -1.57] | |
| ➖ | file_to_blackhole | egress throughput | -2.21 | [-6.34, +1.92] |
Explanation
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
Regression Detector Results
Run ID: 263aa050-84d6-45ee-8bcd-808b6babb819 Metrics dashboard
Baseline: 22a51cddde5f2de950a67bc89956070b3b6cd89d Comparison: a2b152df8a27b74521df2bc437e64fcbf7978307
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
No significant changes in experiment optimization goals
Confidence level: 90.00% Effect size tolerance: |Δ mean %| ≥ 5.00%
There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.
Experiments ignored for regressions
Regressions in experiments with settings containing erratic: true are ignored.
| perf | experiment | goal | Δ mean % | Δ mean % CI | links |
|---|---|---|---|---|---|
| ➖ | file_to_blackhole | egress throughput | -2.76 | [-6.89, +1.36] |
Fine details of change detection per experiment
| perf | experiment | goal | Δ mean % | Δ mean % CI | links |
|---|---|---|---|---|---|
| ➖ | syslog_log2metric_humio_metrics | ingress throughput | +1.73 | [+1.60, +1.85] | |
| ➖ | syslog_log2metric_tag_cardinality_limit_blackhole | ingress throughput | +1.35 | [+1.26, +1.44] | |
| ➖ | datadog_agent_remap_datadog_logs | ingress throughput | +1.24 | [+1.03, +1.45] | |
| ➖ | datadog_agent_remap_blackhole_acks | ingress throughput | +0.98 | [+0.82, +1.14] | |
| ➖ | syslog_splunk_hec_logs | ingress throughput | +0.78 | [+0.70, +0.87] | |
| ➖ | splunk_hec_route_s3 | ingress throughput | +0.78 | [+0.48, +1.08] | |
| ➖ | datadog_agent_remap_datadog_logs_acks | ingress throughput | +0.63 | [+0.42, +0.85] | |
| ➖ | http_elasticsearch | ingress throughput | +0.52 | [+0.38, +0.67] | |
| ➖ | syslog_loki | ingress throughput | +0.32 | [+0.22, +0.41] | |
| ➖ | splunk_hec_to_splunk_hec_logs_noack | ingress throughput | +0.02 | [-0.01, +0.04] | |
| ➖ | http_to_http_acks | ingress throughput | +0.00 | [-0.48, +0.49] | |
| ➖ | http_to_http_noack | ingress throughput | +0.00 | [-0.05, +0.05] | |
| ➖ | http_to_http_json | ingress throughput | -0.00 | [-0.05, +0.05] | |
| ➖ | splunk_hec_indexer_ack_blackhole | ingress throughput | -0.00 | [-0.02, +0.02] | |
| ➖ | datadog_agent_remap_blackhole | ingress throughput | -0.09 | [-0.18, +0.01] | |
| ➖ | splunk_hec_to_splunk_hec_logs_acks | ingress throughput | -0.12 | [-0.16, -0.08] | |
| ➖ | http_text_to_http_json | ingress throughput | -0.30 | [-0.42, -0.19] | |
| ➖ | otlp_grpc_to_blackhole | ingress throughput | -0.62 | [-0.80, -0.44] | |
| ➖ | syslog_log2metric_splunk_hec_metrics | ingress throughput | -0.68 | [-0.79, -0.57] | |
| ➖ | http_to_s3 | ingress throughput | -0.80 | [-0.97, -0.63] | |
| ➖ | fluent_elasticsearch | ingress throughput | -2.04 | [-2.57, -1.52] | |
| ➖ | socket_to_socket_blackhole | ingress throughput | -2.26 | [-2.31, -2.20] | |
| ➖ | syslog_humio_logs | ingress throughput | -2.36 | [-2.50, -2.21] | |
| ➖ | file_to_blackhole | egress throughput | -2.76 | [-6.89, +1.36] | |
| ➖ | syslog_regex_logs2metric_ddmetrics | ingress throughput | -3.54 | [-3.73, -3.35] | |
| ➖ | otlp_http_to_blackhole | ingress throughput | -4.62 | [-4.73, -4.52] |
Explanation
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".