diff --git a/kubernetes_admission/assets/dataflows.yaml b/kubernetes_admission/assets/dataflows.yaml new file mode 100644 index 0000000000000..d24695bc5cbd6 --- /dev/null +++ b/kubernetes_admission/assets/dataflows.yaml @@ -0,0 +1,5 @@ +provides: + - id: kubernetes-admission-events + always_on: false + data_type: events + direction: inbound diff --git a/postgres/assets/logs/postgresql.yaml b/postgres/assets/logs/postgresql.yaml index 0b3ef3ab82eec..c29174ba4207a 100644 --- a/postgres/assets/logs/postgresql.yaml +++ b/postgres/assets/logs/postgresql.yaml @@ -72,9 +72,9 @@ pipeline: suggested_format %{_prefix} %{_severity}:\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg}) #See RDS documentation for more data-rich format - enhanced_rds_with_duration %{_timestamp_ms}:%{_client_ip}\(%{port:network.client.port:integer}\):%{_user}@%{_database}:\[%{_proc_id}\]:%{integer:session_lineno}:%{notSpace:sql_state}:%{_betimestamp}:%{regex("[^:]+"):postgres.vxid}:%{regex("[^:]+"):postgres.xid}:%{regex("[^:]+"):postgres.session_id}:(%{regex("[^:]+"):postgres.appname})?:%{_severity}:\s+duration:\s+%{_duration}\s+ms\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg}) + enhanced_rds_with_duration %{_timestamp_ms}:%{_client_ip}\(%{port:network.client.port:integer}\):%{_user}@%{_database}:\[%{_proc_id}\]:%{integer:session_lineno}:%{notSpace:sql_state}:%{_betimestamp}:%{regex("[^:]+"):postgres.vxid}:%{regex("[^:]+"):postgres.xid}:%{regex("[^:]+"):postgres.session_id}:(%{regex("[^:]+"):postgres.appname})?:%{_severity}:\s*(%{integer}:\s*)?duration:\s+%{_duration}\s+ms\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg}) - enhanced_rds %{_timestamp_ms}:%{_client_ip}\(%{port:network.client.port:integer}\):%{_user}@%{_database}:\[%{_proc_id}\]:%{integer:session_lineno}:%{notSpace:sql_state}:%{_betimestamp}:%{regex("[^:]+"):postgres.vxid}:%{regex("[^:]+"):postgres.xid}:%{regex("[^:]+"):postgres.session_id}:(%{regex("[^:]+"):postgres.appname})?:%{_severity}:\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg}) + enhanced_rds %{_timestamp_ms}:(%{_client_ip}\(%{port:network.client.port:integer}\))?:(%{_user})?@(%{_database})?:\[%{_proc_id}\]:%{integer:session_lineno}:%{notSpace:sql_state}:%{_betimestamp}:%{regex("[^:]+"):postgres.vxid}:%{regex("[^:]+"):postgres.xid}:%{regex("[^:]+"):postgres.session_id}:(%{regex("[^:]+"):postgres.appname}:)?%{_severity}:\s*(%{integer}:\s*)?(%{regex("statement:")}\s+%{_raw_query}|%{data:msg}) default_format (%{_timestamp}|%{_timestamp_ms} \[%{_proc_id}])\s+%{_severity}:\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg}) diff --git a/postgres/assets/logs/postgresql_tests.yaml b/postgres/assets/logs/postgresql_tests.yaml index 3a5796788c0a4..070e73f50272a 100644 --- a/postgres/assets/logs/postgresql_tests.yaml +++ b/postgres/assets/logs/postgresql_tests.yaml @@ -118,3 +118,52 @@ tests: - "source:LOGS_SOURCE" - "db:postgres" timestamp: 1758047205429 + - + sample: "2025-11-19 18:27:10.640 UTC:10.198.137.95(54414):service_catalog_rw@service_catalog:[194370]:4:00000:2025-11-19 18:21:43 UTC:15/174689:276953619:691e0ab7.2f742:PostgreSQL JDBC Driver:LOG: duration: 1626.107 ms plan: {}" + result: + custom: + db: + backend_start: 1763576503000 + date: 1763576830640 + instance: "service_catalog" + severity: "LOG" + user: "service_catalog_rw" + duration: 1.626107E9 + network: + client: + ip: "10.198.137.95" + port: 54414 + postgres: + appname: "PostgreSQL JDBC Driver" + proc_id: "194370" + session_id: "691e0ab7.2f742" + vxid: "15/174689" + xid: "276953619" + session_lineno: 4 + sql_state: "00000" + message: "plan: {}" + status: "info" + tags: + - "source:LOGS_SOURCE" + - "db:service_catalog" + timestamp: 1763576830640 + - + sample: "2025-12-03 19:59:40.415 UTC::@:[1670514]:1:00000:2025-12-03 19:59:26 UTC:20/120887:0:6930969e.197d72:LOG: automatic vacuum of table \"dm_v0.stream_router.kv_shadow_entei\": index scans: 1" + result: + custom: + db: + backend_start: 1764791966000 + date: 1764791980415 + severity: "LOG" + postgres: + proc_id: "1670514" + session_id: "6930969e.197d72" + vxid: "20/120887" + xid: "0" + session_lineno: 1 + sql_state: "00000" + message: "automatic vacuum of table \"dm_v0.stream_router.kv_shadow_entei\": index scans: 1" + status: "info" + tags: + - "source:LOGS_SOURCE" + timestamp: 1764791980415