add trace log to track event size expansion

[kaisecheng]

tested the following pipeline bin/logstash -f split.conf --log.level trace

input {
    generator {
        lines => [
            '{"kubernetes" : {"label": {"app": "somevalue" }}, "split": ["1","2","3"] }'
        ]
        count => 1
        codec => json
    }
}
filter { split { field => "split" }}
output { stdout { } }

log

[2025-11-18T15:29:49,196][TRACE][logstash.filters.split   ][main][e42465377ab12961a4ebbb80634862df2eacd4cc029b3817f2a772eb317df8e7] Event is split into 3 {:split_bytes=>819, :original_bytes=>261, :ratio=>3.14}

[donoghuc]

I think this will be helpful. I wonder if there is a similar log message we should add pre split detailing that we are going to be attempting to split into splits.size events. That way if there is a OOM or something during inflation we would have a log message indicating that the split is being attempted?

[kaisecheng]

@donoghuc Thanks for your considerate suggestion. I have updated the log message and removed an overly verbose debug entry that didn’t add much value. Please have a look.

[donoghuc]

Just out of curiosity... Why are we guarding this with logger.trace? I get it for the other computations as they are somewhat expensive. If i understand correctly, the logging library will handle which messages to actually emit based on level. For example, a message sent with logger.trace('foo') would only ever show up in logs when the trace level logging is configured.

[kaisecheng]

I guard it to prevent paying the cost of string concatenation string + #{splits.size} + string that is not used in other info or debug level.

[kaisecheng]

I guard it to prevent paying the cost of string concatenation string + #{splits.size} + string that is not used in other info or debug level.