Edge Delta Enrichment JavaScript Filter

The enrichment-using-javascript filter can be used to enrich logs using a JavaScript function as they pass through the filter.

To use it, the following requirements must be met:

• the raw log variable must be named “log” in the script.
• the existing attribute tags must be named “tags” in the script.
• the new attribute tags must be named “newTags” in the script.

Enrichment with a Script

Enrichment is only run in the first minute of processing starting with the first log. When the filter executes, the raw log and existing attribute tags are passed in the script before running. When the script completes, the new attribute tags are exported from the script and these new tags are added to the existing attribute tags.

The new tags will not override existing tags - only new key-value pairs are added.

Enrichment Script Example

The following configuration, logs matching the script defined in the script section will be enriched. If keep_log_if_failed is set to true, logs from corresponding source will not be dropped even if enrichment for that source fails

 - name: enrichment_script
   type: enrichment-using-javascript
   script: |
     let newTags = {};
     var obj = JSON.parse(log);
     newTags.service = obj.service;
     newTags.kube_namespace = namespace_name;     
   keep_log_if_failed: true
     

Example input log

Assume the following log and attributes are passed into the filter.

 Log: "{"app": "alpine", "service": "nonprod", "source": "tomcat"}"; 
 Tags: {"namespace_name": "namespace-1"; "image_name": "image-1"}

Example enrichment

New tags are created by the filter after script is executed:

{"service": "nonprod", "kube_namespace": "namespace-1"}

The following source tags are created:

{"namespace_name": "namespace-1"; "image_name": "image-1", "kube_namespace": "namespace-1", "service": "nonprod"}

Required Parameters

name (Required)

The name parameter specifies the name for the filter. You refer to this name in other places, for example to refer to a specific filter in a workflow or processor. Names must be unique within the filters: section. It is a yaml list element so it begins with a - and a space followed by the string. A name is a required parameter for a filter

filters:
  - name: <filter-name>

type: enrichment-using-javascript (Required)

The type parameter in the filter context specifies the type of filter to apply. A type is a required parameter for a filter.

filters:
  - name: <filter-name>
    type: <filter-type>

script (Required)

The script parameter defines the JavaScript function used to apply to matching logs. The script is written in Goja - a type of script in JavaScript. It is a required field for log-transformer-javascript, enrichment-using-javascript, and log-filter-javascript type filters.

filters:
  - name: <filter-name>
  type: <log-transformer-javascript|enrichment-using-javascript|log-filter-javascript>
  script: |
    <Goja-JavaScript-Function>    

Optional Parameters

keep_log_if_failed

The keep_log_if_failed parameter defines how to handle an error when processing the filter. It is defined with a Boolean value true or false. The default value is false indicating that the filter will drop or ignore logs that caused an error. The keep_log_if_failed parameter is optional.

filters:
  - name: <filter-name>
    type: <filter-type>
    keep_log_if_failed: <true|false>