feat: transform k8s event semantic conventions (#168)

.changeset/metal-jokes-run.md

@@ -0,0 +1,6 @@
+---
+'@hyperdx/api': patch
+'@hyperdx/app': patch
+---
+
+feat: transform k8s event semantic conventions

docker/ingestor/core.toml

@@ -411,6 +411,34 @@ if .hdx_platform == "vector-internal" {
         .b = merge(.b, structured, deep: true) ?? .b
       }
 
+      # extract k8s event metadata
+      if .b.object.apiVersion == "events.k8s.io/v1" && .b.object.kind == "Event" {
+        # set severity
+        if is_nullish(.b.level) && (.b.object.type == "Warning" || .b.object.type == "Normal") {
+          .b.level = .b.object.type
+        }
+        # transform the attributes so that the log events use the k8s.* semantic conventions 
+        # ref: https://docs.honeycomb.io/integrations/kubernetes/kubernetes-events/
+        if .b.object.regarding.kind == "Pod" {
+          .b."k8s.pod.name" = .b.object.regarding.name
+          .b."k8s.pod.uid" = .b.object.regarding.uid
+          .b."k8s.namespace.name" = .b.object.regarding.namespace
+        } else if .b.object.regarding.kind == "Node" {
+          .b."k8s.node.name" = .b.object.regarding.name
+          .b."k8s.node.uid" = .b.object.regarding.uid
+        } else if .b.object.regarding.kind == "Job" {
+          .b."k8s.job.name" = .b.object.regarding.name
+          .b."k8s.job.uid" = .b.object.regarding.uid
+          .b."k8s.namespace.name" = .b.object.regarding.namespace
+        } else if .b.object.regarding.kind == "CronJob" {
+          .b."k8s.cronjob.name" = .b.object.regarding.name
+          .b."k8s.cronjob.uid" = .b.object.regarding.uid
+          .b."k8s.namespace.name" = .b.object.regarding.namespace
+        }
+        # set main message
+        .b._hdx_body = .b.object.note
+      }
+
       # set severity after merging structured message (to avoid conflict)
       .st = downcase(.b.level) ?? null