-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
enhancement(aws_s3 source): Logs processed S3 objects #22083
enhancement(aws_s3 source): Logs processed S3 objects #22083
Conversation
Unlike the `aws_sqs` source type, the sqs messaage itself is not the source of events. This logs the bucket and key for files that were ingested via vector in order to have a better audit log. If acknowledgements are enabled, it also logs when they are successfully processed.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should be fine and we also have the internal_log_rate_limit
option on by default which should prevent pathological situations from happening.
Note that this PR needs a changelog, thanks!
src/sources/aws_s3/sqs.rs
Outdated
@@ -215,7 +215,11 @@ pub enum ProcessingError { | |||
#[snafu(display("Unsupported S3 event version: {}.", version,))] | |||
UnsupportedS3EventVersion { version: semver::Version }, | |||
#[snafu(display("Sink reported an error sending events"))] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks much better now. You can also use these fields in #[snafu(display...
like UnsupportedS3EventVersion
does above.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you very much. I've incorporated these into the snafu string.
I appreciate all the handholding you've been providing.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for your contribution!
If all checks pass, this will be added to the merge queue.
Head branch was pushed to by a user without write access
Summary
Adds log events for each object processed from S3 to add an audit trail. This is similar to the events that are logged for the
file
source (started watching, stopped watching).If acknowledgements on the sink are enabled, then this will also log completion of the object.
Unlike the
aws_sqs
source, which converts sqs messages to logs, theaws_s3
source consumes objects that usually contain many logs.Change Type
Is this a breaking change?
How did you test this PR?
Deployed to our test and dev environments, with pipelines that have acknowledgements enabled and others that have it disabled. Reviewed logging.
Does this PR include user facing changes?
Checklist
Cargo.lock
), pleaserun
dd-rust-license-tool write
to regenerate the license inventory and commit the changes (if any). More details here.References