[Logs] Attribute-based exclusion filter #6342
Conversation
|
Hello @pcarioufr , |
|
Preview do not work for me, is that expected? |
content/en/logs/indexes/_index.md
Outdated
| #### Sample all logs of a trace | ||
|
|
||
| In order to guarantee the sampling of all logs related to a given trace, define the log sampling on `Trace Id` attribute. | ||
| Refer to [Trace Remapper][10] to get more information on how to connect logs and traces. | ||
|
|
||
| For example, setting exclude 99% of `Trace Id`, you end up with: | ||
| - 1% of traces for which we keep all logs | ||
| - 99% of traces for which we keep no logs | ||
|
|
There was a problem hiding this comment.
Not sure why we do a specific section out of it. This could be an example of the previous section as it's an attribute like this others even if automatically added by Datadog.
There was a problem hiding this comment.
IMO, this is a specific use-case related to Datadog specific traceId, that's why it's in a subsection.
content/en/logs/indexes/_index.md
Outdated
| #### Sample all logs of a trace | ||
|
|
||
| In order to guarantee the sampling of all logs related to a given trace, define the log sampling on `Trace Id` attribute. | ||
| Refer to [Trace Remapper][10] to get more information on how to connect logs and traces. | ||
|
|
||
| For example, setting exclude 99% of `Trace Id`, you end up with: | ||
| - 1% of traces for which we keep all logs | ||
| - 99% of traces for which we keep no logs | ||
|
|
There was a problem hiding this comment.
IMO, this is a specific use-case related to Datadog specific traceId, that's why it's in a subsection.
content/en/logs/indexes/_index.md
Outdated
| In order to ensure complete log information related to a given subset of transactions, sample on a specific attribute holding an ID, such as User, Session, Request Identifiers. | ||
| By default, the log-based sampling is applied (exclusion percentage set on `all logs`). | ||
|
|
||
| This feature operates on attribute's values rather than the log itself, for example: | ||
| * given an attribute `id` holding 3 distinct values (`1`, `2`, `3`), | ||
| * defining a 66% exclusion filter on it, | ||
| * results in indexing all logs holding 1 specific attribute's value (`3`), all the other logs won't be indexed. | ||
|
|
||
| {{< img src="logs/indexes/index_exclusion_attribute_groups.png" alt="index attribute-based exclusion filter groups" style="width:70%;">}} | ||
|
|
||
| For example, exclude `nginx` logs for 99% of `http.request_id`: | ||
|
|
||
| {{< img src="logs/indexes/index_exclusion_on_attribute.png" alt="index attribute-based exclusion filter" style="width:70%;">}} | ||
|
|
There was a problem hiding this comment.
As discussed, let's focus on the http.request_id example and the trace one and put the emphasis on the fact that the kept traces are complete (which is the key functionality of this new sampling mechanism).
There was a problem hiding this comment.
Yes, session_id and trace_id examples only.
I prefer session instead of request as the latter has no concept of transaction unless we define an exclusion filter with a * query (on every log).
content/en/logs/indexes/_index.md
Outdated
|
|
||
| #### Sample all logs of a trace | ||
|
|
||
| In order to guarantee the sampling of all logs related to a given trace, define the log sampling on `Trace Id` attribute. |
There was a problem hiding this comment.
We could be clearer here, as I'm not sure it's crystal clear what we are trying to say.
Something like the following:
Once [logs and traces are connected], a trace_id attribute is automatically added in the logs. In order to be able to sample those logs but make sure that for the chosen trace ids the full set of logs is kept, an attribute-based exclusion filter should be set on the trace_id attribute.
For example, setting exclude 60% of Trace Id, results in:
- 40% of all traces get all their related logs indexed.
- 60% of all traces have their logs sampled (still available in livetail and archives)
There was a problem hiding this comment.
Indeed better your wording, thanks.
There was a problem hiding this comment.
Actually the last bullet is not correct: for the 60% of traces we don't get any logs indexed.
|
Replacement PR - #6413 |
What does this PR do?
Adds Attribute-based exclusion filter documentation and updates screenshots.
Motivation
Align doc with deployed feature.
Preview link
https://docs-staging.datadoghq.com/gusai-dd-patch-1/logs/indexes/#exclusion-filters