Skip to content

fix: extended detected level for debug and critical level - #18370

Merged
trevorwhitney merged 4 commits into
grafana:mainfrom
mbaykara:main
Aug 28, 2025
Merged

fix: extended detected level for debug and critical level#18370
trevorwhitney merged 4 commits into
grafana:mainfrom
mbaykara:main

Conversation

@mbaykara

@mbaykara mbaykara commented Jul 9, 2025

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:
Extend detected level for debug and critical log level

Special notes for your reviewer:

Checklist

  • Reviewed the CONTRIBUTING.md guide (required)
  • Documentation added
  • Tests updated
  • Title matches the required conventional commits format, see here
    • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
  • Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
  • If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR
@mbaykara
mbaykara requested a review from a team as a code owner July 9, 2025 10:15
@mbaykara mbaykara changed the title extend detected level for debug and critical level Jul 9, 2025

@shantanualsi shantanualsi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@trevorwhitney trevorwhitney left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we've had problems in the past when not including the : in the match. I think we need to keep the : to avoid unexpected matches.

@trevorwhitney

Copy link
Copy Markdown
Collaborator

Related PR: #17615

@mbaykara
mbaykara requested a review from trevorwhitney August 14, 2025 15:54
@mbaykara

Copy link
Copy Markdown
Contributor Author

fyi: @trevorwhitney I updated and extended

@trevorwhitney trevorwhitney left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

approving to unblock as I know a lot of people have been waiting for the bracket functionality, but I'm hesitant about the matches on critical and debug as those will match if they're a substring. I'd prefer explicitly matching on those only if they have whitespace around them in that case, but since there's precedent for other levels doing that we can merge as is and wait to see if anyone files a bug for false positives, as I'm not sure how commonly those will show up as substrings.

Comment thread pkg/distributor/field_detection.go Outdated
if strings.Contains(log, "CRITICAL:") || strings.Contains(log, "critical:") {
if strings.Contains(log, "CRITICAL:") || strings.Contains(log, "critical:") ||
strings.Contains(log, "[critical]") || strings.Contains(log, "[CRITICAL]") ||
strings.Contains(log, "critical") || strings.Contains(log, "CRITICAL") {

@trevorwhitney trevorwhitney Aug 14, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

strings like critical without any special characters around them are likely to cause false positives. however, since I see we already have that pattern in here we can merge and wait to see if we get a bug report for false positives, at which point I recommend removing all the ones without special characters, or at least adding whitespace to the matcher.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, without special characters it might cause false positives especially for critical. Should I remove that lines? even with whitespace could cause false postives.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

my preference would be we only match on critical: and [critical], both lowercase and uppercase variants

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I made the changes for critical and error try to avoid false positive for both.

@trevorwhitney
trevorwhitney merged commit 2b01a31 into grafana:main Aug 28, 2025
67 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3 participants