opensearch-project / opensearch-project/data-prepper
Extract values from Grok with the correct type
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 374
- Forks
- 354
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 8
Description
Is your feature request related to a problem? Please describe.
The grok processor currently creates all Event values as strings. For example, when grokking on an Apache HTTP log, all response values are strings. This prevents a pipeline author from creating conditional routing expressions which perform comparisons such as /response < 500.
Describe the solution you'd like
The grok processor can have two options to help pipeline authors.
- Manual configuration of pattern types.
- Automatic conversion of pattern types for pre-defined patterns.
Manual configuration
Provide a configuration that allows the grok processor to convert specific patterns. This new configuration - conversions - would take a map of patterns to destination types.
For example:
grok:
conversions:
INT: integer
NUMBER: decimal
MY_CUSTOM_NUMBER: integer
Automatic configuration
Provide a setting that allows the grok processor to automatically convert specific patterns which it has pre-included. The grok processor has some default patterns like INT. Most pipeline authors probably want these to automatically get the correct type. The grok processor can automatically convert these known patterns.
This would be a change of behavior. So, I propose that this configure be disabled by default, but in a future major version we would enable it.
Thus, to use it in Data Prepper 2.0.
grok:
disable_automatic_conversion: false
But, perhaps in Data Prepper 3.0, the default value here becomes false. So pipeline authors no longer have to specify it.
Describe alternatives you've considered (Optional)
Ask pipeline authors to use a casting processor as requested in #2010. The solution using grok can be easier for pipeline authors, especially with an automatic conversion.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the grok processor and the casting processor discussed in issue #2010, then determine how manual conversions and automatic conversion of predefined patterns should coexist. Done means a documented configuration and behavior for converting values such as INT and NUMBER while preserving the proposed default and versioning semantics.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100