Skip to content

opentelemetry source: gRPC log writes not being processed #14463

Description

@char8

A note for the community

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

We're trying to ingest logs from the Envoy proxy envoy.access_loggers.open_telemetry extension into vector with the opentelemetry source.

Configuring envoy to output logs directly to vector shows H2 connections and data frames in debug logs, but no log entries reach the sink and we see no errors. Metrics on the Envoy side show bytes written and no errors.

opentelemetry-collector can receive these logs using gRPC, and we can re-export them from there to vectors opentelemetry gRPC source which works fine.

Configuration

[api]
enabled = true

[sources.otel]
type = "opentelemetry"

[sources.otel.grpc]
address = "0.0.0.0:4317"

[sources.otel.http]
address = "0.0.0.0:4318"

[sinks.console]
inputs = ["otel.logs"]
target = "stdout"
type = "console"

[sinks.console.encoding]
codec = "json"

Version

vector 0.25.0 (x86_64-unknown-linux-gnu d498040 2022-09-18)

Debug Output

❯ RUST_BACKTRACE=full VECTOR_LOG=debug ./vector -vvv -c ../../vector.toml                                                                                                                                                                                                                                                                                                  
2022-09-18T20:19:50.023446Z  INFO vector::app: Log level is enabled. level="debug"
2022-09-18T20:19:50.023522Z  INFO vector::app: Loading configs. paths=["../../vector.toml"]
2022-09-18T20:19:50.024195Z DEBUG vector::config::loading: No secret placeholder found, skipping secret resolution.
2022-09-18T20:19:50.024608Z DEBUG vector::topology::builder: Building new source. component=otel
2022-09-18T20:19:50.025015Z DEBUG vector::topology::builder: Building new sink component=console
2022-09-18T20:19:50.025111Z  INFO vector::topology::running: Running healthchecks.
2022-09-18T20:19:50.025125Z DEBUG vector::topology::running: Connecting changed/added component(s).
2022-09-18T20:19:50.025142Z DEBUG vector::topology::running: Configuring outputs for source. component=otel
2022-09-18T20:19:50.025174Z DEBUG vector::topology::running: Configuring output for component. component=otel output_id=Some("logs")
2022-09-18T20:19:50.025189Z DEBUG vector::topology::running: Connecting inputs for sink. component=console
2022-09-18T20:19:50.025203Z DEBUG vector::topology::running: Adding component input to fanout. component=console fanout_id=otel.logs
2022-09-18T20:19:50.025208Z  INFO vector::topology::builder: Healthcheck: Passed.
2022-09-18T20:19:50.025233Z DEBUG vector::topology::running: Spawning new source. key=otel
2022-09-18T20:19:50.025289Z DEBUG source{component_kind="source" component_id=otel component_type=opentelemetry component_name=otel}: vector::topology::builder: Source pump starting.
2022-09-18T20:19:50.025335Z  INFO vector: Vector has started. debug="false" version="0.25.0" arch="x86_64" build_id="d498040 2022-09-18"
2022-09-18T20:19:50.025356Z  INFO vector::internal_events::api: API server running. address=127.0.0.1:8686 playground=http://127.0.0.1:8686/playground
2022-09-18T20:19:50.025406Z  INFO source{component_kind="source" component_id=otel component_type=opentelemetry component_name=otel}: vector::sources::util::grpc: Building gRPC server. address=0.0.0.0:4317
2022-09-18T20:19:50.025573Z  INFO source{component_kind="source" component_id=otel component_type=opentelemetry component_name=otel}: vector::sources::opentelemetry::http: Building HTTP server. address=0.0.0.0:4318
2022-09-18T20:19:50.026530Z DEBUG sink{component_kind="sink" component_id=console component_type=console component_name=console}: vector::utilization: utilization=0.025099934072720376
2022-09-18T20:19:52.118279Z DEBUG h2::codec::framed_write: send frame=Settings { flags: (0x0), initial_window_size: 1048576, max_frame_size: 16384, max_header_list_size: 16777216 }
2022-09-18T20:19:52.118441Z DEBUG Connection{peer=Server}: h2::codec::framed_read: received frame=Settings { flags: (0x0), header_table_size: 4096, enable_push: 0, max_concurrent_streams: 2147483647, initial_window_size: 268435456, enable_connect_protocol: 0 }
2022-09-18T20:19:52.118459Z DEBUG Connection{peer=Server}: h2::codec::framed_write: send frame=Settings { flags: (0x1: ACK) }
2022-09-18T20:19:52.118466Z DEBUG Connection{peer=Server}: h2::codec::framed_read: received frame=WindowUpdate { stream_id: StreamId(0), size_increment: 268369921 }
2022-09-18T20:19:52.118515Z DEBUG Connection{peer=Server}: h2::codec::framed_read: received frame=Headers { stream_id: StreamId(1), flags: (0x4: END_HEADERS) }
2022-09-18T20:19:52.118543Z DEBUG Connection{peer=Server}: h2::codec::framed_read: received frame=Data { stream_id: StreamId(1) }
2022-09-18T20:19:52.118551Z DEBUG Connection{peer=Server}: h2::codec::framed_read: received frame=Settings { flags: (0x1: ACK) }
2022-09-18T20:19:52.118557Z DEBUG Connection{peer=Server}: h2::proto::settings: received settings ACK; applying Settings { flags: (0x0), initial_window_size: 1048576, max_frame_size: 16384, max_header_list_size: 16777216 }
2022-09-18T20:19:52.118569Z DEBUG Connection{peer=Server}: h2::codec::framed_write: send frame=WindowUpdate { stream_id: StreamId(0), size_increment: 983041 }
2022-09-18T20:19:53.628788Z DEBUG Connection{peer=Server}: h2::codec::framed_read: received frame=Data { stream_id: StreamId(1) }
2022-09-18T20:19:55.027120Z DEBUG sink{component_kind="sink" component_id=console component_type=console component_name=console}: vector::utilization: utilization=0.0025100078055733882
2022-09-18T20:19:55.580393Z DEBUG Connection{peer=Server}: h2::codec::framed_read: received frame=Data { stream_id: StreamId(1) }

Example Data

Currently sending a fixed body {"foo": "baz"} with each log event. This is what the event looks like when logged by opentelemetry-collector.

opentelemetry_logs-otel-1      | 2022-09-18T20:25:02.747Z       info    LogsExporter    {"kind": "exporter", "data_type": "logs", "name": "logging", "#logs": 1}
opentelemetry_logs-otel-1      | 2022-09-18T20:25:02.747Z       info    ResourceLog #0
opentelemetry_logs-otel-1      | Resource SchemaURL: 
opentelemetry_logs-otel-1      | Resource labels:
opentelemetry_logs-otel-1      |      -> log_name: STRING(access_logs)
opentelemetry_logs-otel-1      |      -> zone_name: STRING()
opentelemetry_logs-otel-1      |      -> cluster_name: STRING()
opentelemetry_logs-otel-1      |      -> node_name: STRING()
opentelemetry_logs-otel-1      |      -> region: STRING(foo)
opentelemetry_logs-otel-1      | ScopeLogs #0
opentelemetry_logs-otel-1      | ScopeLogs SchemaURL: 
opentelemetry_logs-otel-1      | InstrumentationScope  
opentelemetry_logs-otel-1      | LogRecord #0
opentelemetry_logs-otel-1      | ObservedTimestamp: 1970-01-01 00:00:00 +0000 UTC
opentelemetry_logs-otel-1      | Timestamp: 2022-09-18 20:25:02.742701 +0000 UTC
opentelemetry_logs-otel-1      | Severity: 
opentelemetry_logs-otel-1      | Body: {
opentelemetry_logs-otel-1      |      -> foo: STRING(baz)
opentelemetry_logs-otel-1      | }
opentelemetry_logs-otel-1      | Trace ID: 
opentelemetry_logs-otel-1      | Span ID: 
opentelemetry_logs-otel-1      | Flags: 0
opentelemetry_logs-otel-1      |        {"kind": "exporter", "data_type": "logs", "name": "logging"}

When vector ingests these from opentelemetry-collector, the vector event written to the sink looks like:

{"dropped_attributes_count":0,"message":{"foo":"baz"},"observed_timestamp":"2022-09-18T20:25:02.748308562Z","resources":{"cluster_name":"","log_name":"access_logs","node_name":"","region":"foo","zone_name":""},"source_type":"opentelemetry","timestamp":"2022-09-18T20:25:02.742701Z"}                                                                                 

Additional Context

Ideally we'd like to avoid running opentelemetry-collector in front of vector. Is there any further steps we can take to debug why vector isn't ingesting logs / not showing any errors when Envoy is directly sending logs to it?

To get it to work, this is the opentelemetry-collector config we're using

receivers:
  otlp:
    protocols:
      grpc:
      http:

exporters:
  logging:
    loglevel: debug
  otlp:
    endpoint: vector:4317
    tls:
      insecure: true

service:
  pipelines:
    logs:
      receivers: [otlp]
      exporters: [logging,otlp]

References

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions