wankai123 opened a new pull request, #13955:
URL: https://github.com/apache/skywalking/pull/13955

   ### Route LAL rules within a layer by input type; add `envoy-als-tcp`
   
   LAL rules keyed to the same telemetry layer are all evaluated against every 
log of
   that layer. When a layer carries more than one proto input shape this 
breaks: the
   generated `parsed.*` code casts the input unconditionally, so a rule 
compiled for one
   proto throws `ClassCastException` on another. On `Layer.MESH` both HTTP and 
TCP Envoy
   access logs (and network-profiling `LogData`) share the bucket, so the HTTP 
`envoy-als`
   rule already throws — caught in `LogFilterListener.build()` and logged per 
log — whenever
   a TCP entry or a network-profiling log arrives.
   
   This PR makes rule dispatch input-type aware:
   
   - Each compiled rule now carries its **effective input type** — the proto 
class its
     `parsed.*` getters cast to, or `null` for parser-based 
(`json`/`yaml`/`text`) and
     untyped rules, which continue to run against any input. Derived once at 
compile time
     in `LALClassGenerator` and threaded onto the `DSL`.
   - `LogFilterListener.parse()` skips any rule whose declared input type does 
not match the
     incoming object (`inputType.isInstance(input)`), so each entry only 
reaches the rules
     meant for it. This removes the latent `ClassCastException` and the per-log 
WARN spam.
   - Routing keys off the **effective** type, not the resolved one, so a 
parser-based rule
     such as `network-profiling-slow-trace` (whose SPI-resolved type is 
`HTTPAccessLogEntry`
     but which reads a parsed map) is never wrongly filtered.
   
   Adds an `envoy-als-tcp` rule (`inputType: 
io.envoyproxy.envoy.data.accesslog.v3.TCPAccessLogEntry`)
   alongside the existing HTTP `envoy-als`; both share `Layer.MESH` and each 
now only sees
   its own entry type. TCP entries have no HTTP status code, so the rule 
filters on
   `commonProperties.responseFlags` and samples by `service:responseFlags`.
   
   ### New feature / behavior
   - [x] This builds on the existing LAL per-rule `inputType` + 
`LALSourceTypeProvider` SPI
     mechanism (documented in `oap-server/analyzer/log-analyzer/CLAUDE.md`); no 
separate design doc.
   - [x] Update the documentation to include this new feature. (CHANGES log)
   - [x] Tests (UT) are added to verify the new feature.
   - [x] Not UI related.
   
   ### Also fixes a latent bug
   - [x] Added unit tests reproducing the mixed-input-type dispatch 
(`LogFilterListenerRoutingTest`):
     an HTTP entry reaches only the HTTP + parser rules, a TCP entry only the 
TCP + parser rules,
     no cross-type `ClassCastException`.
   - [x] Root cause: `parsed.*` codegen emits an unguarded proto cast, and 
every rule in a layer
     runs against every input; fix routes by the rule's effective input type 
before evaluation.
   
   ### Tests added
   - `LogFilterListenerRoutingTest` — routing selection (3 cases).
   - `LALClassGeneratorExtractorTest` — `effectiveInputType` derivation (parser 
⇒ `null`) and a
     compile guard for the shipped `envoy-als-tcp` rule against 
`TCPAccessLogEntry`.
   - `envoy-als-tcp` data-driven execution cases in `LALScriptExecutionTest` 
(abnormal ⇒ tag +
     save; normal ⇒ abort).
   
   - [ ] If this pull request closes/resolves/fixes an existing issue, replace 
the issue number. Closes #<issue number>.
   - [x] Update the [`CHANGES` 
log](https://github.com/apache/skywalking/blob/master/docs/en/changes/changes.md).
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to