[performance-profiler] Reduce dissect processor per-event allocations by reusing parsed map
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 54m
- Merged PRs (30d)
- 381
Description
## Hot Path
`libbeat/processors/dissect/processor.go:106-112` (`Run`) allocates a fresh `Map` every event via `Dissect`, and `libbeat/processors/dissect/dissect.go:57-86` always allocates in `Dissect`.
## Profiling Data
**Benchmark command (before and after):**
`go test -run '^$' -bench '^BenchmarkDissectProcessor/6_fields_default_prefix$' -benchmem -count=8 ./libbeat/processors/dissect`
**Before:**
```text
BenchmarkDissectProcessor/6_fields_default_prefix-4 562165 2157 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 543412 2196 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 546796 2172 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 554584 2164 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 570710 2213 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 565899 2167 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 572408 2333 ns/op 1216 B/op 14 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 570957 2170 ns/op 1216 B/op 14 allocs/op
```
## Proposed Change
Reuse a pre-sized map for the non-convert path instead of allocating per event:
- Add `DissectToMap(s string, m Map)` in `libbeat/processors/dissect/dissect.go` so callers can provide reusable storage.
- In `libbeat/processors/dissect/processor.go`, detect once whether datatype conversion is needed, and for the non-convert path use a `sync.Pool`-backed `Map` (`getMap`/`putMap`) around `DissectToMap`.
## Results
**After (same command):**
```text
BenchmarkDissectProcessor/6_fields_default_prefix-4 581244 2144 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 590821 2116 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 574497 2104 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 589068 2103 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 585229 2322 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 584200 2167 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 599150 2129 ns/op 880 B/op 12 allocs/op
BenchmarkDissectProcessor/6_fields_default_prefix-4 557530 2136 ns/op 880 B/op 12 allocs/op
```
**Improvement (mean across 8 runs):**
- `ns/op`: 2196.5 → 2152.6 (**~2.0% faster**)
- `B/op`: 1216 → 880 (**~27.6% lower**)
- `allocs/op`: 14 → 12 (**~14.3% lower**)
## Verification
- `go test ./libbeat/processors/dissect -count=1` passes on the optimized code.
- Behavior is preserved: parsing logic and field mapping remain unchanged; only allocation strategy changes for the non-convert path.
## Evidence
Commands executed:
- `go test -run '^$' -bench '^BenchmarkDissectProcessor/6_fields_default_prefix$' -benchmem -count=8 ./libbeat/processors/dissect` (before)
- apply optimization in `dissect.go` + `processor.go`
- `go test -run '^$' -bench '^BenchmarkDissectProcessor/6_fields_default_prefix$' -benchmem -count=8 ./libbeat/processors/dissect` (after)
- `go test ./libbeat/processors/dissect -count=1`
> [!NOTE]
>
> 🔒 Integrity filter blocked 1 item
>
> The following item were blocked because they don't meet the GitHub integrity level.
>
> - [#50754](https://github.com/elastic/beats/issues/50754) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>
---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Performance Profiler](https://github.com/elastic/beats/actions/runs/26171066230)
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 27, 2026, 3:21 PM UTC
Contributor guide
Assessment
This issue has not been assessed yet.