fkie-cad / Logprep

log data pre processing, generation and shipping in python
https://logprep.readthedocs.io/en/latest/
GNU Lesser General Public License v2.1
31 stars 8 forks source link

add abiltity to configure error output #668

Closed ekneg54 closed 3 weeks ago

ekneg54 commented 2 months ago

This changes the error handling implementation of logprep. This PR aims at two main goals.

  1. no error should permit further processing

This is handled by not raising FatalOutputError or FatalInputError but instead raise a CriticalInputError or a CriticalOutputError. No error is handled in the pipeline process anymore all error causing events are written to error output. To achieve this, I had to change the batch_finished_callback mechanic. As now every event gotten from input via get_next is committed to kafka utilizing the batch_finished_callback mechanic in the pipeline.py. no connections between intput and output connectors anymore.

  1. no event should get lost

to make it simple. This PR has to ensure, that every event goes into output, error output or gets logged to console as last resort.

Every error raising event will be serialized together with its raising error to an error event and is put into a multiprocessing.Queue (ThrottlingQueue). In the main Thread these events were handled in a configured error output connector which indeed can be any output connector implemented in logprep.

To achieve theses goals I had to reimplement the opensearch output connector to simplify things a lot.

Please have a look on my changes and lets discuss. Feel free to give feedback and to ask your questions. It is a very big PR. Sorry for that but the cut was a fundamental one.

ekneg54 commented 1 month ago

additional work:

codecov-commenter commented 1 month ago

Codecov Report

Attention: Patch coverage is 91.03448% with 26 lines in your changes missing coverage. Please review.

Project coverage is 94.09%. Comparing base (eca9240) to head (1e150eb). Report is 14 commits behind head on main.

Files with missing lines Patch % Lines
logprep/connector/opensearch/output.py 72.50% 11 Missing :warning:
logprep/framework/pipeline_manager.py 91.20% 8 Missing :warning:
logprep/framework/pipeline.py 90.90% 7 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #668 +/- ## ========================================== - Coverage 94.27% 94.09% -0.18% ========================================== Files 146 146 Lines 9777 9914 +137 ========================================== + Hits 9217 9329 +112 - Misses 560 585 +25 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.