Edge Delta Enrichment JavaScript Filter
3 minute read
The enrichment-using-javascript filter can be used to enrich logs using a JavaScript function as they pass through the filter.
To use it, the following requirements must be met:
- the raw log variable must be named “log” in the script.
- the existing attribute tags must be named “tags” in the script.
- the new attribute tags must be named “newTags” in the script.
Enrichment with a Script
Enrichment is only run in the first minute of processing starting with the first log. When the filter executes, the raw log and existing attribute tags are passed in the script before running. When the script completes, the new attribute tags are exported from the script and these new tags are added to the existing attribute tags.
The new tags will not override existing tags - only new key-value pairs are added.
Enrichment Script Example
The following configuration, logs matching the script defined in the script section will be enriched.
If keep_log_if_failed
is set to true
, logs from corresponding source will not be dropped even if enrichment for that source fails
- name: enrichment_script
type: enrichment-using-javascript
script: |
let newTags = {};
var obj = JSON.parse(log);
newTags.service = obj.service;
newTags.kube_namespace = namespace_name;
keep_log_if_failed: true
Example input log
Assume the following log and attributes are passed into the filter.
Log: "{"app": "alpine", "service": "nonprod", "source": "tomcat"}";
Tags: {"namespace_name": "namespace-1"; "image_name": "image-1"}
Example enrichment
New tags are created by the filter after script is executed:
{"service": "nonprod", "kube_namespace": "namespace-1"}
The following source tags are created:
{"namespace_name": "namespace-1"; "image_name": "image-1", "kube_namespace": "namespace-1", "service": "nonprod"}
Required Parameters
name (Required)
The name
parameter specifies the name for the filter. You refer to this name in other places, for example to refer to a specific filter in a workflow or processor. Names must be unique within the filters:
section. It is a yaml list element so it begins with a -
and a space followed by the string. A name is a required parameter for a filter
filters:
- name: <filter-name>
type: enrichment-using-javascript (Required)
The type
parameter in the filter context specifies the type of filter to apply. A type is a required parameter for a filter.
filters:
- name: <filter-name>
type: <filter-type>
script (Required)
The script
parameter defines the JavaScript function used to apply to matching logs. The script is written in Goja - a type of script in JavaScript. It is a required field for log-transformer-javascript
, enrichment-using-javascript
, and log-filter-javascript
type filters.
filters:
- name: <filter-name>
type: <log-transformer-javascript|enrichment-using-javascript|log-filter-javascript>
script: |
<Goja-JavaScript-Function>
Optional Parameters
keep_log_if_failed
The keep_log_if_failed
parameter defines how to handle an error when processing the filter. It is defined with a Boolean value true
or false
. The default value is false
indicating that the filter will drop or ignore logs that caused an error. The keep_log_if_failed
parameter is optional.
filters:
- name: <filter-name>
type: <filter-type>
keep_log_if_failed: <true|false>