opensearch-project / opensearch-project/data-prepper

Extract values from Grok with the correct type

Open
#2,009 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

breaking change enhancement plugin - processor
Dominant language
Java
Stars
374
Forks
354
Avg merge
3d 18h
Merged PRs (30d)
8

Description

Is your feature request related to a problem? Please describe.

The grok processor currently creates all Event values as strings. For example, when grokking on an Apache HTTP log, all response values are strings. This prevents a pipeline author from creating conditional routing expressions which perform comparisons such as /response < 500.

Describe the solution you'd like

The grok processor can have two options to help pipeline authors.

  1. Manual configuration of pattern types.
  2. Automatic conversion of pattern types for pre-defined patterns.

Manual configuration

Provide a configuration that allows the grok processor to convert specific patterns. This new configuration - conversions - would take a map of patterns to destination types.

For example:

grok:
  conversions:
    INT: integer
    NUMBER: decimal
    MY_CUSTOM_NUMBER: integer

Automatic configuration

Provide a setting that allows the grok processor to automatically convert specific patterns which it has pre-included. The grok processor has some default patterns like INT. Most pipeline authors probably want these to automatically get the correct type. The grok processor can automatically convert these known patterns.

This would be a change of behavior. So, I propose that this configure be disabled by default, but in a future major version we would enable it.

Thus, to use it in Data Prepper 2.0.

grok:
  disable_automatic_conversion: false

But, perhaps in Data Prepper 3.0, the default value here becomes false. So pipeline authors no longer have to specify it.

Describe alternatives you've considered (Optional)

Ask pipeline authors to use a casting processor as requested in #2010. The solution using grok can be easier for pipeline authors, especially with an automatic conversion.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the grok processor and the casting processor discussed in issue #2010, then determine how manual conversions and automatic conversion of predefined patterns should coexist. Done means a documented configuration and behavior for converting values such as INT and NUMBER while preserving the proposed default and versioning semantics.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.