Skip to content

Conversation

@zmoog
Copy link
Contributor

@zmoog zmoog commented Jan 28, 2026

Description

This PR brings over the remaining Activity log categories from translator/azurelogs, aligning this component with the changes made in #44871.

New log categories:

  • Administrative
  • Alert
  • Autoscale
  • Policy
  • Security
  • ServiceHealth
  • ResourceHealth

Testing

We added test cases for each category, leveraging the same log events found in translator/azurelogs for consistency.

Documentation

Added a section covering Identity (including its major subfields) along with dedicated sections for each new log category.

@zmoog zmoog requested review from a team and axw as code owners January 28, 2026 17:03
@github-actions github-actions bot requested a review from constanca-m January 28, 2026 17:03
@zmoog zmoog marked this pull request as draft January 28, 2026 17:09
@zmoog zmoog changed the title [extension/azure_encoding] Port Activity logs from translator/azurelogs [extension/azure_encoding] Add support for Alert, Autoscale, Policy, Recommendation, Security, ServiceHealth, and ResourceHealth log categories. Jan 28, 2026
@zmoog zmoog changed the title [extension/azure_encoding] Add support for Alert, Autoscale, Policy, Recommendation, Security, ServiceHealth, and ResourceHealth log categories. [extension/azure_encoding] Add support for Administrative, Alert, Autoscale, Policy, Security, ServiceHealth, and ResourceHealth log categories. Jan 28, 2026
@zmoog zmoog marked this pull request as ready for review January 28, 2026 17:42
@zmoog
Copy link
Contributor Author

zmoog commented Jan 28, 2026

@Fiery-Fenix, I’d love to get your eyes on this as well, whenever you have a chance.

zmoog added 12 commits January 29, 2026 13:13
# Conflicts:
#	extension/encoding/azureencodingextension/internal/unmarshaler/logs/README.md
#	extension/encoding/azureencodingextension/internal/unmarshaler/logs/category.go
#	extension/encoding/azureencodingextension/internal/unmarshaler/logs/helpers.go
Use the tranlator/azurelogs test document
Use the translator/azurelogs test document
Use the translator/azurelogs test document
Use the translator/azurelogs test document
Use the translator/azurelogs test document
@zmoog zmoog force-pushed the zmoog/azureencodingextension/port-activitylogs-from-translator branch from 95b92f4 to 4028542 Compare January 29, 2026 12:17
// log record.
// Extract common claim fields

if iss := id.Claims[identityClaimIssuer]; iss != "" {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think for readability it would be better to use map, except for timestamps of course
Something like:

claimAttributesMap := map[string]string{
  "iss": attributeIdentityClaimsIssuer,
  ....
}
for k, v := range claimAttributesMap {
  if value, has := id.Claim[k]; has {
    unmarshaler.AttrPutStrIf(attrs, v, value)
  }
}

@@ -85,3 +88,12 @@ func attrPutTLSProtoIf(attrs pcommon.Map, securityProtocol string) {
unmarshaler.AttrPutStrIf(attrs, string(conventions.TLSProtocolNameKey), name)
unmarshaler.AttrPutStrIf(attrs, string(conventions.TLSProtocolVersionKey), version)
}

// parseUnixTimestamp parses a Unix timestamp string (seconds since epoch) and returns a time.Time
func parseUnixTimestamp(s string) (time.Time, error) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about test for this function?

// ------------------------------------------------------------

if id.Authorization != nil {
attrs.PutStr(attributeIdentityAuthorizationScope, id.Authorization.Scope)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we interested in empty values for this attributes?
If no - we should probably use unmarshaler.AttrPutStrIf(attrs, _attribute_, _value_) to avoid empty values for output attributes, if any

)

// Constants for Identity > claims
const (
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe it make sense to extract all Identity parsing code into separate file? As it's already 160+ lines of code

@Fiery-Fenix
Copy link
Contributor

Also I think it's better to place all test data (input json files and expected yaml files) into single folder that correlates with name of code file that is actually parsing them, like it done for other category_*.go files.
As we parsing all new Categories in this PR in category_activitylogs.go so all test data files should be placed into testdata/activitylogs folder.
It's simplify finding of respective test data during debugging/issue investigation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants