Skip to content

Partner parsers#701

Open
prasoonbirla-google wants to merge 34 commits intomainfrom
partner-parsers
Open

Partner parsers#701
prasoonbirla-google wants to merge 34 commits intomainfrom
partner-parsers

Conversation

@prasoonbirla-google
Copy link
Copy Markdown
Contributor

Title (Please follow the convention below)

Please use a clear and concise title that summarizes your changes.
If this PR is related to an internal Buganizer ticket, please include its ID at the beginning.

Convention: [Optional Buganizer ID: 123456789] Short, descriptive title of changes

Examples:

  • Fix: Resolve issue with API endpoint returning 500 error
  • [Buganizer ID: 987654321] Feature: Add support for custom data types
  • Docs: Update README with installation instructions

Description

Please provide a detailed description of your changes. This helps reviewers understand your work and its context.

What problem does this PR solve?
(e.g., "Fixes a bug where X was happening," "Implements feature Y to allow Z," "Improves performance of function A.")

How does this PR solve the problem?
(e.g., "Modified algorithm in src/foo.js," "Added new component Bar.vue," "Updated dependency baz to version 1.2.3.")

Any other relevant information (e.g., design choices, tradeoffs, known issues):
(e.g., "Chose approach A over B due to performance considerations," "This change might affect X in certain edge cases," "Requires manual migration steps for existing users.")


Checklist:

Please ensure you have completed the following items before submitting your PR.
This helps us review your contribution faster and more efficiently.

General Checks:

  • I have read and followed the project's contributing.md guide.
  • My code follows the project's coding style guidelines.
  • I have performed a self-review of my own code.
  • My changes do not introduce any new warnings.
  • My changes pass all existing tests.
  • I have added new tests where appropriate to cover my changes. (If applicable)
  • I have updated the documentation where necessary (e.g., README, API docs). (If applicable)

Open-Source Specific Checks:

  • My changes do not introduce any Personally Identifiable Information (PII) or sensitive customer data.
  • My changes do not expose any internal-only code examples, configurations, or URLs.
  • All code examples, comments, and messages are generic and suitable for a public repository.
  • I understand that any internal context or sensitive details related to this work are handled separately in internal systems (Buganizer for Google team members).

For Google Team Members and Reviewers Only:

  • I have included the Buganizer ID in the PR title or description (e.g., "Internal Buganizer ID: 123456789" or "Related Buganizer: go/buganizer/123456789").
  • I have ensured that all internal discussions and PII related to this work remain in Buganizer.
  • I have tagged the PR with one or more labels that reflect the pull request purpose.

Screenshots (If Applicable)

If your changes involve UI or visual elements, please include screenshots or GIFs here.
Ensure any sensitive data is redacted or generalized.


Further Comments / Questions

Any additional comments, questions, or areas where you'd like specific feedback.

@prasoonbirla-google prasoonbirla-google requested review from a team as code owners April 21, 2026 06:56
@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new log parser configuration for 'DUMMY_LOGTYPE', structured to support both community and partner integrations. It includes the required configuration files, metadata, and comprehensive test data to ensure correct parsing behavior.

Highlights

  • New Parser Implementation: Added a new parser for 'DUMMY_LOGTYPE' under both community and partner directories, including necessary configuration and test data.
  • Documentation Updates: Added minor whitespace adjustments to README.md and docs/contributing.md for formatting consistency.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a new log parser for 'DUMMY_LOGTYPE' in both the community and partner directories, along with associated metadata and test data. The review feedback highlights a functional discrepancy where the parser output for the 'additional' field does not match the expected test results. Additionally, the reviewer noted the use of placeholder values in metadata files, which violates production-ready requirements, and suggested optimizations for the grok pattern to improve performance and remove redundant configurations.

Comment on lines +47 to +59
if ![msg_empty] {
mutate {
replace => {
"msg_label.key" => "msg"
}
}
mutate {
merge => {
"event.idm.read_only_udm.additional.fields" => "msg_label"
}
on_error => "msg_label_empty"
}
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The parser logic for the additional field does not align with the expected output structure defined in test_events.json. The current code merges a msg_label object into additional.fields, while the expected JSON shows the message directly under additional.msg.

    if ![msg_empty] {
      mutate {
        replace => {
          "event.idm.read_only_udm.additional.msg" => "%{msg}"
        }
      }
    }

Comment on lines +2 to +5
"product": "DUMMY Product",
"vendor": "Test Vendor",
"description": "Some sort of product from this vendor.",
"log_type": "DUMMY_LOGTYPE"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This file contains placeholder "DUMMY" and "Test Vendor" values. Per the Repository Style Guide, contributions must be production-ready and not just functionally correct. Please update the metadata with the actual product, vendor, and log type information. Additionally, note that identical placeholder files have been added to both the community and partner directories; ensure that only the intended final versions are committed to the correct paths.

References
  1. Contributions must be production-ready, which includes using actual product and vendor information rather than placeholders. (link)

grok {
match => {
"message" => [
"%{GREEDYDATA:event_data} \\| %{GREEDYDATA:kv_msg}"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using multiple GREEDYDATA patterns separated by a literal can be inefficient due to potential backtracking. Since the separator is a pipe, consider using DATA (non-greedy) for the first part to improve performance and ensure correct splitting if multiple pipes are present in the log.

        "%{DATA:event_data} \\| %{GREEDYDATA:kv_msg}"

"%{GREEDYDATA:event_data} \\| %{GREEDYDATA:kv_msg}"
]
}
overwrite => ["event_data" ,"msg" ,"kv_msg"]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The field msg is included in the overwrite list, but it is not defined as a named capture in the grok pattern on line 16. This makes its inclusion in the overwrite list redundant.

    overwrite => ["event_data", "kv_msg"]

@prasoonbirla-google prasoonbirla-google changed the title Partner parsers Partner parsers kjhk Apr 21, 2026
@prasoonbirla-google prasoonbirla-google changed the title Partner parsers kjhk Partner parsers Apr 21, 2026
@prasoonbirla-google prasoonbirla-google changed the title Partner parsers Partner parsers hkjhkj Apr 21, 2026
@prasoonbirla-google prasoonbirla-google changed the title Partner parsers hkjhkj Partner parsers Apr 21, 2026
@prasoonbirla-google prasoonbirla-google changed the title Partner parsers Partner parsers kjhjk Apr 21, 2026
@prasoonbirla-google prasoonbirla-google changed the title Partner parsers kjhjk Partner parsers Apr 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant