fix: adapt kubernetes event#29591
Conversation
|
❌ Author of the following commits did not sign a Contributor Agreement: Please, read and sign the above mentioned agreement if you want to contribute to this project |
❕ Build Aborted
Expand to view the summary
Build stats
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
|
Hello @mtojek,I need to use this branch to avoid introducing other modifications in our environment. |
|
I'm afraid that you have to use your own fork in this case. We don't actively backport/support old branches. If you want to add a feature or code modification, feel free to start with the main branch and we can backport it to other places. |
@mtojek ok,I will rebase my code. |
b0309d6 to
8d175b6
Compare
|
This pull request does not have a backport label. Could you fix it @xjh1996? 🙏
NOTE: |
|
/Team:Integrations |
|
/test |
|
Pinging @elastic/integrations (Team:Integrations) |
ChrsMark
left a comment
There was a problem hiding this comment.
Hey @xjh1996, thank you very much for your contribution!
I have some concerns about the implementation but the direction is in general sth that we can adopt so let me provide some feedback and we can discuss on it and iterate on the PR:
- +1 on using
eve.Series.Countas fallback wheneve.Countis not present. - I would suggest using
eve.EventTimeas fallback whenFirstTimestampis not present - +1 on using
eve.Series.LastObservedTimeas fallback wheneve.LastTimestampis not present.
Let me know what you think :).
| lastTimestamp := kubernetes.EventLastTimestamp(eve) | ||
| tsMap["first_occurrence"] = func() time.Time { | ||
| if eve.FirstTimestamp.IsZero() { | ||
| return kubernetes.Time(&lastTimestamp).UTC() |
There was a problem hiding this comment.
I'm not sure if this is correct. If an event has no FirstTimestamp attached then we fallback to lastTimestamp so this means that each time the event occurs we emit data with different first_occurrence which is always equal to the current lastTimestamp. Is this something that is intentional, and if so why?
Maybe it's better here to use EventTime as a fallback?
| } else if !eve.EventTime.IsZero() { | ||
| lastTimestamp = metav1.Time(eve.EventTime) | ||
| } else { | ||
| lastTimestamp = eve.CreationTimestamp |
There was a problem hiding this comment.
Does this field actually exist? I cannot find on the version of the client library we use (v1.21): https://github.com/kubernetes/api/blob/release-1.21/core/v1/types.go#L5463
| if eve.Series != nil && !eve.Series.LastObservedTime.IsZero() { | ||
| lastTimestamp = metav1.Time(eve.Series.LastObservedTime) | ||
| } else if !eve.EventTime.IsZero() { | ||
| lastTimestamp = metav1.Time(eve.EventTime) |
There was a problem hiding this comment.
Here we fallback to a value that is described as Time when this Event was first observed, is this something that is actually correct? EventTime is mostly a good fallback if FirstTimestamp is not present.
What does this PR do?
adapt kubernetes event which lastTimestamp is empty or count is empty
Why is it important?
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Author's Checklist
How to test this PR locally
Related issues
Use cases
Screenshots
Logs