[Filebeat] aws-s3 - Disable event normalization processing #33673
Conversation
botelastic
bot
added
the
needs_team
|
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
Disable event normalization for the aws-s3 input to reduce allocations when processing events. The input only produces basic types in its events. Either it puts a string into the `message` field or it decodes json into a map[string]interface with encoding/json. Both of those should be fine for the downstream processors and outputs. Relates elastic#33657
andrewkroh
force-pushed
the
feature/fb/aws-s3-disable-normalization
branch
from
9f9c060
to
4ccb09d
Compare
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
botelastic
bot
removed
the
needs_team
andrewkroh
added
needs_team
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
botelastic
bot
removed
the
needs_team
|
This pull request doesn't have a |
| @@ -368,3 +373,6 @@ func getProviderFromDomain(endpoint string, ProviderOverride string) string { | |||
| } | |||
| return "unknown" | |||
| } | |||
|
|
|||
| // boolPtr returns a pointer to b. | |||
| func boolPtr(b bool) *bool { return &b } | |||
There was a problem hiding this comment.
| func boolPtr(b bool) *bool { return &b } | |
| func ptr[T any](v bool) *T { return &v } |
🤣
There was a problem hiding this comment.
I've got to start thinking more generically. 😆
Disable event normalization for the aws-s3 input to reduce allocations when processing events. The input only produces basic types in its events. Either it puts a string into the `message` field or it decodes json into a map[string]interface with encoding/json. Both of those should be fine for the downstream processors and outputs. Relates #33657
What does this PR do?
Disable event normalization for the aws-s3 input to reduce allocations when processing events. The input only produces basic types in its events. Either it puts a string into the
messagefield or it decodes json into a map[string]interface with encoding/json. Both of those should be fine for the downstream processors and outputs.Relates #33657
Why is it important?
It makes Filebeat more efficient.
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Related issues
Screenshots