By using parse_key_value the key-values are not getting into the output

[uni-pooja-laad]

Hi team,
in contineousion of https://discord.com/channels/742820443487993987/1288128207111065650/1295892531246268540
I am using remap with parse_key_value. The vector configuration file attached. The log coming from datadog_agent attached in the file orch_swepper_logs.yaml.
In Datadog it is appearing without tags attached screenshot. (filename: after.png)
Before applying this remap, the tags were getting properly, that Screenshot too attached(filename: before.png)
Why this is happening? I just used it to parse ddtags key and fetch kube_namespace from it to match with the condition.


orch_swepper_logs.json
vector-config-ai.txt
Attaching vector-config-ai as txt as json format not supported here.

[pront]

Hi @uni-pooja-laad,

A few things that might help here. The logs intake API expects something like this, specifically this line:

ddtags="env:staging,version:5.1",

Also, see this playground example:

# convert to an object from a string
.ddtags = parse_key_value!(.ddtags, field_delimiter: ",", key_value_delimiter: ":")

---

The JSON sample you provided correctly specifies the .ddtags as a command separated list of key/value pairs. Then, your remap will transform them to:

"ddtags": {
  "container_id": "cf52b15db2f21be1d7e337e4dab1d5fb56e48eec9726c9490a5b0b4aeb19202f",
  "container_name": "uzng-orchestrator-sweeper",
  "dirname": "/var/log/pods/uanalyze-ng_uzng-orchestrator-sweeper-7cbb66d745-jkkvh_60bf03a7-d4a2-4649-a1d6-7558fc4a7677/uzng-orchestrator-sweeper",
  "display_container_name": "uzng-orchestrator-sweeper_uzng-orchestrator-sweeper-7cbb66d745-jkkvh",
  "env": "staging",
  "filename": "0.log",
  "image_id": "registry.uniphore.com/uniphore/uzng-orchestrator-sweeper@sha256:5752555d80dde7bd1c34d2a860bad98556566dfc871dc05c324e1d008c0ded4b",
  "image_name": "registry.uniphore.com/uniphore/uzng-orchestrator-sweeper",
  "image_tag": "v-d46b297c1e",
  "kube_app_instance": "uzng-orchestrator-sweeper",
  "kube_app_managed_by": "Helm",
  "kube_app_name": "uzng-orchestrator-sweeper",
  "kube_container_name": "uzng-orchestrator-sweeper",
  "kube_deployment": "uzng-orchestrator-sweeper",
  "kube_namespace": "uanalyze-ng",
  "kube_ownerref_kind": "replicaset",
  "kube_ownerref_name": "uzng-orchestrator-sweeper-7cbb66d745",
  "kube_qos": "Burstable",
  "kube_replica_set": "uzng-orchestrator-sweeper-7cbb66d745",
  "pod_name": "uzng-orchestrator-sweeper-7cbb66d745-jkkvh",
  "pod_phase": "running",
  "service": "uzng-orchestrator-sweeper",
  "short_image": "uzng-orchestrator-sweeper",
  "version": "v-d46b297c1e"
}

The above allows you to access the individual tags by keys e.g. .ddtags.kube_app_name.

Finally, the datadog logs sink will internally take this object and convert it back to a single string. Are you modifying the above object in any other way after the parse_ai_ns transform?

[uni-pooja-laad]

It worked by assigning parsed values to new variable and then using it:

  parse_ai_ns:
    type: remap
    inputs: [filter_ai_ns]
    source: |-
      .datadogtags = parse_key_value!(.ddtags, field_delimiter: ",", key_value_delimiter: ":")
      .timestamp = now()
       .vector_tag = "yes"
  get_ai_ns:
    inputs: [parse_ai_ns]
    type: filter
    condition: 
      type: "vrl"
      source: .datadogtags.kube_namespace=="ai"

[pront]

It worked by assigning parsed values to new variable

This works because you left the original ddtags as a string with the expected format. Also, I looked at the implementation here:
https://github.com/vectordotdev/vector/blob/master/src/sinks/datadog/logs/sink.rs#L112-L129

and it turns out the sink expects the tags to be a string or an array. So the following object won't be converted to the correct format:

"ddtags": {
  "container_id": "cf52b15db2f21be1d7e337e4dab1d5fb56e48eec9726c9490a5b0b4aeb19202f",
  "container_name": "uzng-orchestrator-sweeper",
  ...
}

Arguably we could make the sink smarter but that would be a separate enhancement request.

If you had an array in the event e.g. "ddtags": [ "container_id:foo", "container_name:bar", ... ] then it would have been converted to the correct format inside the sink.

Hopes this answer covers everything.