diff --git a/confgenerator/logging_receivers.go b/confgenerator/logging_receivers.go index 25a1bf0de9..0f0a9c3035 100644 --- a/confgenerator/logging_receivers.go +++ b/confgenerator/logging_receivers.go @@ -617,8 +617,12 @@ func windowsEventLogV1Processors(ctx context.Context) ([]otel.Component, error) ) }, }, - // TODO: Convert from array of maps to array of strings - "jsonPayload.StringInserts": {CopyFrom: "jsonPayload.event_data.data"}, + "jsonPayload.StringInserts": { + CopyFrom: "jsonPayload.event_data.data", + CustomConvertFunc: func(v ottl.LValue) ottl.Statements { + return v.Set(ottl.ToValues(v)) + }, + }, "jsonPayload.TimeGenerated": { CopyFrom: "jsonPayload.system_time", CustomConvertFunc: formatSystemTime, diff --git a/confgenerator/otel/ottl/ottl.go b/confgenerator/otel/ottl/ottl.go index 830d323acb..4c0f68d3cc 100644 --- a/confgenerator/otel/ottl/ottl.go +++ b/confgenerator/otel/ottl/ottl.go @@ -176,6 +176,10 @@ func FormatTime(a Value, format string) Value { return valuef(`FormatTime(%s, %q)`, a, format) } +func ToValues(a Value) Value { + return valuef(`ToValues(%s)`, a) +} + func IsMatch(target Value, pattern string) Value { return valuef(`IsMatch(%s, %q)`, target, pattern) } diff --git a/confgenerator/testdata/goldens/logging-otel-processor_modify_fields/golden/windows-2012/otel.yaml b/confgenerator/testdata/goldens/logging-otel-processor_modify_fields/golden/windows-2012/otel.yaml index de95c69679..bc8fd96bfd 100644 --- a/confgenerator/testdata/goldens/logging-otel-processor_modify_fields/golden/windows-2012/otel.yaml +++ b/confgenerator/testdata/goldens/logging-otel-processor_modify_fields/golden/windows-2012/otel.yaml @@ -713,6 +713,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -820,6 +821,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -927,6 +929,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) diff --git a/confgenerator/testdata/goldens/logging-otel-processor_modify_fields/golden/windows/otel.yaml b/confgenerator/testdata/goldens/logging-otel-processor_modify_fields/golden/windows/otel.yaml index de95c69679..bc8fd96bfd 100644 --- a/confgenerator/testdata/goldens/logging-otel-processor_modify_fields/golden/windows/otel.yaml +++ b/confgenerator/testdata/goldens/logging-otel-processor_modify_fields/golden/windows/otel.yaml @@ -713,6 +713,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -820,6 +821,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -927,6 +929,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) diff --git a/confgenerator/testdata/goldens/logging-otel-processor_parse_json/golden/windows-2012/otel.yaml b/confgenerator/testdata/goldens/logging-otel-processor_parse_json/golden/windows-2012/otel.yaml index 05ec7d5578..0d1cafbb70 100644 --- a/confgenerator/testdata/goldens/logging-otel-processor_parse_json/golden/windows-2012/otel.yaml +++ b/confgenerator/testdata/goldens/logging-otel-processor_parse_json/golden/windows-2012/otel.yaml @@ -679,6 +679,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -786,6 +787,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -893,6 +895,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) diff --git a/confgenerator/testdata/goldens/logging-otel-processor_parse_json/golden/windows/otel.yaml b/confgenerator/testdata/goldens/logging-otel-processor_parse_json/golden/windows/otel.yaml index 05ec7d5578..0d1cafbb70 100644 --- a/confgenerator/testdata/goldens/logging-otel-processor_parse_json/golden/windows/otel.yaml +++ b/confgenerator/testdata/goldens/logging-otel-processor_parse_json/golden/windows/otel.yaml @@ -679,6 +679,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -786,6 +787,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -893,6 +895,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) diff --git a/confgenerator/testdata/goldens/logging-otel-receiver_files_refresh_interval/golden/windows-2012/otel.yaml b/confgenerator/testdata/goldens/logging-otel-receiver_files_refresh_interval/golden/windows-2012/otel.yaml index 2ca8b73e34..327206239e 100644 --- a/confgenerator/testdata/goldens/logging-otel-receiver_files_refresh_interval/golden/windows-2012/otel.yaml +++ b/confgenerator/testdata/goldens/logging-otel-receiver_files_refresh_interval/golden/windows-2012/otel.yaml @@ -624,6 +624,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -731,6 +732,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -838,6 +840,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) diff --git a/confgenerator/testdata/goldens/logging-otel-receiver_files_refresh_interval/golden/windows/otel.yaml b/confgenerator/testdata/goldens/logging-otel-receiver_files_refresh_interval/golden/windows/otel.yaml index 2ca8b73e34..327206239e 100644 --- a/confgenerator/testdata/goldens/logging-otel-receiver_files_refresh_interval/golden/windows/otel.yaml +++ b/confgenerator/testdata/goldens/logging-otel-receiver_files_refresh_interval/golden/windows/otel.yaml @@ -624,6 +624,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -731,6 +732,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) @@ -838,6 +840,7 @@ processors: - set(body["SourceName"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_10"]) + - set(cache["value"], ToValues(cache["value"])) - set(body["StringInserts"], cache["value"]) where (cache != nil and cache["value"] != nil) - delete_key(cache, "value") where (cache != nil and cache["value"] != nil) - set(cache["value"], cache["__field_11"]) diff --git a/transformation_test/testdata/windows_event_log_v1/output_otel.yaml b/transformation_test/testdata/windows_event_log_v1/output_otel.yaml index aab5cd1b36..bb9a13e8b3 100644 --- a/transformation_test/testdata/windows_event_log_v1/output_otel.yaml +++ b/transformation_test/testdata/windows_event_log_v1/output_otel.yaml @@ -11,8 +11,8 @@ Sid: "" SourceName: Service Control Manager StringInserts: - - param1: Windows Modules Installer - - param2: running + - Windows Modules Installer + - running TimeGenerated: 2025-07-02 20:38:45.0260774 +0000 TimeWritten: 2025-07-02 20:38:45.0260774 +0000 logName: projects/my-project/logs/my-log-name @@ -34,8 +34,8 @@ Sid: "" SourceName: Service Control Manager StringInserts: - - param1: Software Protection - - param2: stopped + - Software Protection + - stopped TimeGenerated: 2025-07-02 20:39:32.3390061 +0000 TimeWritten: 2025-07-02 20:39:32.3390061 +0000 logName: projects/my-project/logs/my-log-name