[pkg/ottl] Allow checking path type

[danelson]

Component(s)

internal/filter, processor/transform

Is your feature request related to a problem? Please describe.

I have a log pipeline where I consume logs of different formats. The log body may be of few forms:

• kvlistValue

  "body":
  {
    "kvlistValue":
    {
      "values":
      [
        {
          "key": "message",
          "value":
          {
            "stringValue": "kvlistValue message"
          }
        }
      ]
    }
  }

• stringValue
  • pure string

    "body":
    {
      "stringValue": "this is a message"
    }

  • json string

    "body":
    {
      "stringValue": "{\"message\":\"stringValue message\"}"
    }

• other? (not sure if this is possible)

When the log is not a pure string I would like to move data to attributes. Currently I do this with the transformprocessor as follows:

transform/move_body_to_attributes:
    error_mode: ignore
    log_statements:
      - context: log
        statements:
          - merge_maps(attributes, body, "insert") where IsMatch(body, "^\\{")
          - merge_maps(attributes, ParseJSON(body), "insert") where IsMatch(body, "^\\{")
          - set(body, "") where IsMatch(body, "^\\{")

This seems to work ok but I get one of the following warnings depending on whether body is a kvlistValue or a stringValue

expected string but got pcommon.Map

or

expected pcommon.Map but got string

Describe the solution you'd like

I would like a way to determine the type of an object in the transform processor. Something like the following

- merge_maps(attributes, body, "insert") where IsMatch(body, "^\\{") and body is kvlistValue
- merge_maps(attributes, ParseJSON(body), "insert") where IsMatch(body, "^\\{") and body is stringValue

Describe alternatives you've considered

No response

Additional context

The problem is written specific to my use case but it might apply more generally.

[github-actions]

Pinging code owners:

• internal/filter: @open-telemetry/collector-approvers
• processor/transform: @TylerHelmuth @kentquirk @bogdandrutu @evan-bradley

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[evan-bradley]

This would be fairly easy by adding Converters that use a typed Getter to return whether the Getter throws an error for the path. Checking whether a body is a map could then look like:

merge_maps(attributes, body, "insert") where IsMap(body)

An alternative approach could be a Type function that could be used like Type(body) == "map", but I don't see an easy way to statically validate that the string is a valid value, and it's more to type, so I think a function per Getter is a better approach.

[TylerHelmuth]

Agreed. Also providing more type converters, like String() could help with these checks.

Also an ErrorMode that ignores the warnings and doesn't log anything could be nice.

[evan-bradley]

Also an ErrorMode that ignores the warnings and doesn't log anything could be nice.

I think we should proceed with caution on this one, but that could be good if we can articulate when to use it. I've opened an issue for further discussion here: #22743.

[TylerHelmuth]

@evan-bradley for the type checking function, do you think it should consider literal string and pcommon.ValueTypeString as the same? If body is a string it is really a ValueTypeString.

[evan-bradley]

I think sticking to whatever passes the StringGetter check will be the clearest for function authors and users. Looking at StringGetter though, maybe we should handle converting pcommon.ValueTypeString values to string values as part of the Get method. I wouldn't expect a user to know which paths contain primitive values vs. ones that contain pdata of the same underlying primitive type when writing an OTTL statement.

[TylerHelmuth]

Agreed, I think we should probably be treating them the same within OTTL. I'll submit a separate PR to update StringGetter and PMapGetter.