Skip to content
This repository has been archived by the owner on Aug 30, 2019. It is now read-only.

filters: add a span tag replace filters #398

Merged
merged 1 commit into from
Mar 14, 2018
Merged

filters: add a span tag replace filters #398

merged 1 commit into from
Mar 14, 2018

Conversation

gbbr
Copy link
Contributor

@gbbr gbbr commented Mar 14, 2018

This change adds a new setting (only Agent 6 for now) which allows to
set regular expressions in order to parse tag values. This helps hide
sensitive information from the UI. A new configuration example is:

apm_config:
    # ...
    # allows the same tag multiple times
    # the replacement should be a user defined string
    # this list of regex applies to all Spans of a trace
    replace_tags:
         - name: "*"
           pattern: "user_id/([^/]*)"
           repl: "?"
         - name: "http.url"
           pattern: "token/(.*)"
           repl: "?"
         - name: "http.url"
           pattern: "guid"
           repl: "[REDACTED]"
         - name: "custom.tag"
           pattern: "something"
           repl: "something_else"
         - name: "error.stack"
           pattern: "(?s).*"

@gbbr gbbr requested review from LotharSee and palazzem March 14, 2018 10:14
@gbbr gbbr force-pushed the gbbr/tag-filters branch 2 times, most recently from fea8f62 to 1a3aaf8 Compare March 14, 2018 12:38
@gbbr
Copy link
Contributor Author

gbbr commented Mar 14, 2018

@LotharSee I've changed this. Would be great if you could take a look.

return md, nil
}

func ParseReplaceRulesFromString(rules [][3]string) (map[string]map[*regexp.Regexp]string, error) {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should move this function from here. Either to the test package where it is used, or by converting the tests to the new format.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@gbbr gbbr force-pushed the gbbr/tag-filters branch from 1a3aaf8 to 90e4529 Compare March 14, 2018 12:58
"github.com/DataDog/datadog-trace-agent/model"
)

var _ Filter = (*tagReplacer)(nil)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the purpose of this line?

Copy link
Contributor Author

@gbbr gbbr Mar 14, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is a common pattern that shows that the structure implements the Filter interface, as well as tests that by failing at compile time.

For the latter it may many times not be needed because other code might be already using this structure as that interface, in which case compiling will fail anyway. But I have made it a habit to do this because in many cases that doesn't happen. I don't feel strongly about it but I think it's a good thing to have.

It is used a lot in the standard library too. Check this example.

config/agent.go Outdated

// RawReplaceTags holds the unparsed replace rules. They are here for expvar.
RawReplaceTags []*replaceRule `json:"ReplaceTags"`

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about using a structure to wrap these two?
Something similar to replaceRule could also hold the its built Regexp then a list of it would be enough to be stored in the config. It allows both to have have a single struct and place per rule, and to have something simpler than map[string]map[*regexp.Regexp]string.
As tagReplacer.Keep is iterating over the tags anyway, it doesn't change much to keep only a list.

That's a nitpick though.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I wasn't too pleased about this either, I think I've iterated a bit too much over the code and it became messy. I also "copied" the PR from our internal ticket a little bit. I like your suggestion. I'm gonna try it out.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually what you've suggested in here worked, and I've added. PTAL. And thanks, it helps to have a second pair of eyes. I wasn't very happy with the initial version but I think now it's looking better.

@gbbr gbbr force-pushed the gbbr/tag-filters branch from 90e4529 to 81478b2 Compare March 14, 2018 13:28
@@ -288,6 +306,25 @@ func readExponentialBackoffConfigYaml(yc queueablePayloadSender) backoff.Exponen
return c
}

// parseReplaceRules takes a set of replace rules, validates and parses them,
// returning the corresponding map containing compiled regular expressions.
func parseReplaceRules(rules []*ReplaceRule) error {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will rename this to "compileReplaceRules" and change the docs too after your review. I don't want to do that while you are potentially looking :)

@gbbr
Copy link
Contributor Author

gbbr commented Mar 14, 2018

FYI the following config:

# ...
apm_config:
    # ...
    replace_tags:
         - name: "http.url"
           pattern: "guid"
           repl: "[REDACTED]"
         - name: "http.url"
           pattern: "(token/)([^/]*)"
           repl: "${1}[HIDDEN]"
         - name: "custom.tag"
           pattern: "something"
           repl: "something_else"

Tested on staging:
screen shot 2018-03-14 at 2 48 05 pm

Copy link

@LotharSee LotharSee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Good job!

@gbbr gbbr force-pushed the gbbr/tag-filters branch from 81478b2 to 269a095 Compare March 14, 2018 13:53
This change adds a new setting (only Agent 6 for now) which allows to
set regular expressions in order to parse tag values. This helps hide
sensitive information from the UI. A new configuration example is:

```
apm_config:
    # ...
    # allows the same tag multiple times
    # the replacement should be a user defined string
    # this list of regex applies to all Spans of a trace
    replace_tags:
         - name: "*"
           pattern: "user_id/([^/]*)"
           repl: "?"
         - name: "http.url"
           pattern: "token/(.*)"
           repl: "?"
         - name: "http.url"
           pattern: "guid"
           repl: "[REDACTED]"
         - name: "custom.tag"
           pattern: "something"
           repl: "something_else"
```
@gbbr gbbr force-pushed the gbbr/tag-filters branch from 269a095 to c0072af Compare March 14, 2018 14:00
@gbbr gbbr merged commit 0976879 into master Mar 14, 2018
@gbbr
Copy link
Contributor Author

gbbr commented Mar 14, 2018

Thanks for your help!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants