Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: trim large events in Athena querier #35402

Merged
merged 3 commits into from
Dec 7, 2023
Merged

fix: trim large events in Athena querier #35402

merged 3 commits into from
Dec 7, 2023

Commits on Dec 6, 2023

  1. fix: trim large events in Athena querier 

    Fixes #35161

Large events queried from the Athena audit backend will now be trimmed
before they are stored and before they are returned from a query
according to the existing TrimToMaxSize implementations for each event
type already used by the Dynamo and File backends.

The other backends typically trim the event before storing it, for
Dynamo this is due to the 400 KB item size limit, for the file backend
it's due to the 64 KiB bufio.MaxScanTokenSize.

There is no hard limit to events stored in Parquet files in S3, but
we've been using a 2 GiB limit in the publisher so far.
With this change we will attempt to trim events to 2 GiB before writing
them (if we haven't already run out of memory) instead of just failing.

We've also been using a 1 MiB limit in the querier and just returning an
empty result when an event larger than that is encountered.
With this change we will attempt to trim the event to 1MiB before
returning it.
The 1 MiB limit ultimately stems from the 4MB max gRPC message size.

We could just trim to 1 MiB in the publisher, but I'd prefer to preserve
as much of the event data as possible in case we improve the querying
story for large events in the future (and in case the user wants to
query the events directly from S3).
    @nklaassen
    nklaassen committed Dec 6, 2023
    Configuration menu
    Copy the full SHA
    06a3847 View commit details
    Browse the repository at this point in the history

  2. use trace.Errorf 

    Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
    @nklaassen @rosstimothy
    nklaassen and rosstimothy committed Dec 6, 2023
    Configuration menu
    Copy the full SHA
    52bb792 View commit details
    Browse the repository at this point in the history

  3. fix parens

    @nklaassen
    nklaassen committed Dec 6, 2023
    Configuration menu
    Copy the full SHA
    c7aa53f View commit details
    Browse the repository at this point in the history