high cardinality in loki when using SIP TCP

[tsearle]

when capturing sip TCP traffic, the src port is always dynamic, this causes a very high cardinality for the src_port dst_port labels.

I propose to have a flag to omit src/dst port labels when the protocol is TCP to reduce cardinality

[lmangani]

@tsearle why not just switching off LokiIPPortLabels? I see little purpose in keeping ports for TCP only and creating a fracture. We can add yet another parameter of course, but I want to make sure I understand the usecase.

[tsearle]

that flag disables too much, w/o the ip labels, I can not make callflow ladder diagrams or sensible pcaps

[tsearle]

alternatively I was wondering if I could use xheaders_write() in kamailio, and put the src/dest into the sip message and then extract it out like the callid

[lmangani]

@tsearle absolutely, its possible and many people do that - of course it'll use more memory when exploding at query time

[lmangani]

FYI @tsearle the next version doesn't need any of this trickery