elastic / elastic/beats

[performance-profiler] Reduce dissect processor per-event allocations by reusing parsed map

Open
#50,811 1 comment 0 reactions 0 assignees View on GitHub
needs_team
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 54m
Merged PRs (30d)
381

Description

## Hot Path
`libbeat/processors/dissect/processor.go:106-112` (`Run`) allocates a fresh `Map` every event via `Dissect`, and `libbeat/processors/dissect/dissect.go:57-86` always allocates in `Dissect`.

## Profiling Data
**Benchmark command (before and after):**
`go test -run '^$' -bench '^BenchmarkDissectProcessor/6_fields_default_prefix$' -benchmem -count=8 ./libbeat/processors/dissect`

**Before:**
```text
BenchmarkDissectProcessor/6_fields_default_prefix-4 562165 2157 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 543412 2196 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 546796 2172 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 554584 2164 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 570710 2213 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 565899 2167 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 572408 2333 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 570957 2170 ns/op 1216 B/op 14 allocs/op
```

## Proposed Change
Reuse a pre-sized map for the non-convert path instead of allocating per event:

- Add `DissectToMap(s string, m Map)` in `libbeat/processors/dissect/dissect.go` so callers can provide reusable storage.
- In `libbeat/processors/dissect/processor.go`, detect once whether datatype conversion is needed, and for the non-convert path use a `sync.Pool`-backed `Map` (`getMap`/`putMap`) around `DissectToMap`.

## Results
**After (same command):**
```text
BenchmarkDissectProcessor/6_fields_default_prefix-4 581244 2144 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 590821 2116 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 574497 2104 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 589068 2103 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 585229 2322 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 584200 2167 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 599150 2129 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 557530 2136 ns/op 880 B/op 12 allocs/op
```

**Improvement (mean across 8 runs):**
- `ns/op`: 2196.5 → 2152.6 (**~2.0% faster**)
- `B/op`: 1216 → 880 (**~27.6% lower**)
- `allocs/op`: 14 → 12 (**~14.3% lower**)

## Verification
- `go test ./libbeat/processors/dissect -count=1` passes on the optimized code.
- Behavior is preserved: parsing logic and field mapping remain unchanged; only allocation strategy changes for the non-convert path.

## Evidence
Commands executed:
- `go test -run '^$' -bench '^BenchmarkDissectProcessor/6_fields_default_prefix$' -benchmem -count=8 ./libbeat/processors/dissect` (before)
- apply optimization in `dissect.go` + `processor.go`
- `go test -run '^$' -bench '^BenchmarkDissectProcessor/6_fields_default_prefix$' -benchmem -count=8 ./libbeat/processors/dissect` (after)
- `go test ./libbeat/processors/dissect -count=1`

> [!NOTE]
>
> 🔒 Integrity filter blocked 1 item
>
> The following item were blocked because they don't meet the GitHub integrity level.
>
> - [#50754](https://github.com/elastic/beats/issues/50754) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Performance Profiler](https://github.com/elastic/beats/actions/runs/26171066230)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 27, 2026, 3:21 PM UTC

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.