Ralph/alp log querying benchmark#53105
Closed
rhy988 wants to merge 12 commits into
Closed
Conversation
Contributor
Go Package Import DifferencesBaseline: f43a236
|
This comment has been minimized.
This comment has been minimized.
rhy988
force-pushed
the
ralph/alp-log-querying-benchmark
branch
2 times, most recently
from
July 2, 2026 06:58
1b3a804 to
e9298c3
Compare
dd-octo-sts
Bot
added
internal
Contributor
Files inventory check summaryFile checks results against ancestor f43a2366: Results for datadog-agent_7.82.0~devel.git.653.fa521b6.pipeline.123134204-1_amd64.deb:No change detected |
Contributor
Static quality checks❌ Please find below the results from static quality gates Error
Gate failure full details
Static quality gates prevent the PR to merge! Successful checksInfo
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: f43a236 Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ❌ | logs_filter_ottl | % cpu utilization | +1710.19 | [+1697.52, +1722.86] | 1 | Logs |
| ❌ | logs_filter_jq | % cpu utilization | +340.10 | [+333.28, +346.91] | 1 | Logs |
| ➖ | logs_filter_baseline | % cpu utilization | -0.82 | [-2.42, +0.78] | 1 | Logs |
Fine details of change detection per experiment
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ❌ | logs_filter_ottl | % cpu utilization | +1710.19 | [+1697.52, +1722.86] | 1 | Logs |
| ❌ | logs_filter_jq | % cpu utilization | +340.10 | [+333.28, +346.91] | 1 | Logs |
| ➖ | quality_gate_metrics_logs | memory utilization | +2.26 | [+2.01, +2.52] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle | memory utilization | +2.02 | [+1.96, +2.07] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle_all_features | memory utilization | +1.61 | [+1.58, +1.65] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_mean_fs_load | memory utilization | +1.61 | [+1.58, +1.65] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_idle | memory utilization | +1.31 | [+1.25, +1.38] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_no_fs_load | memory utilization | +1.10 | [+1.00, +1.20] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_logs | % cpu utilization | +0.39 | [-0.68, +1.46] | 1 | Logs bounds checks dashboard |
| ➖ | logs_filter_baseline | % cpu utilization | -0.82 | [-2.42, +0.78] | 1 | Logs |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | observed_value | links |
|---|---|---|---|---|---|
| ✅ | quality_gate_idle | intake_connections | 10/10 | 3 ≤ 4 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | 147.49MiB ≤ 154MiB | bounds checks dashboard |
| ✅ | quality_gate_idle | total_bytes_received | 10/10 | 580KiB ≤ 819.20KiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | 3 ≤ 4 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | 489.00MiB ≤ 495MiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | total_bytes_received | 10/10 | 0.89MiB ≤ 1.25MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | 3 ≤ 6 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | 182.39MiB ≤ 195MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_logs | total_bytes_received | 10/10 | 264.25MiB ≤ 292MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | 390.32 ≤ 2000 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | 3 ≤ 6 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | 400.25MiB ≤ 430MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | total_bytes_received | 10/10 | 0.86GiB ≤ 1.04GiB | bounds checks dashboard |
| ✅ | quality_gate_security_idle | cpu_usage | 10/10 | 30.15 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_security_idle | memory_usage | 10/10 | 302.61MiB ≤ 330MiB | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | cpu_usage | 10/10 | 62.54 ≤ 80 | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | memory_usage | 10/10 | 282.45MiB ≤ 310MiB | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | cpu_usage | 10/10 | 23.75 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | memory_usage | 10/10 | 284.96MiB ≤ 320MiB | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
Replicate Execution Details
We run multiple replicates for each experiment/variant. However, we allow replicates to be automatically retried if there are any failures, up to 8 times, at which point the replicate is marked dead and we are unable to run analysis for the entire experiment. We call each of these attempts at running replicates a replicate execution. This section lists all replicate executions that failed due to the target crashing or being oom killed.
Note: In the below tables we bucket failures by experiment, variant, and failure type. For each of these buckets we list out the replicate indexes that failed with an annotation signifying how many times said replicate failed with the given failure mode. In the below example the baseline variant of the experiment named experiment_with_failures had two replicates that failed by oom kills. Replicate 0, which failed 8 executions, and replicate 1 which failed 6 executions, all with the same failure mode.
| Experiment | Variant | Replicates | Failure | Logs | Debug Dashboard |
|---|---|---|---|---|---|
| experiment_with_failures | baseline | 0 (x8) 1 (x6) | Oom killed | Debug Dashboard |
The debug dashboard links will take you to a debugging dashboard specifically designed to investigate replicate execution failures.
❌ Retried Profiling Replicate Execution Failures (ddprof)
Note: Profiling replicas may still be executing. See the debug dashboard for up to date status.
| Experiment | Variant | Replicates | Failure | Debug Dashboard |
|---|---|---|---|---|
| logs_filter_baseline | baseline | 10 | Oom killed | Debug Dashboard |
| logs_filter_baseline | comparison | 10 | Oom killed | Debug Dashboard |
| logs_filter_jq | baseline | 10 | Oom killed | Debug Dashboard |
| logs_filter_jq | comparison | 10 | Oom killed | Debug Dashboard |
| logs_filter_ottl | baseline | 10 | Oom killed | Debug Dashboard |
| logs_filter_ottl | comparison | 10 | Oom killed | Debug Dashboard |
| quality_gate_idle_all_features | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_idle_all_features | comparison | 10 | Oom killed | Debug Dashboard |
| quality_gate_logs | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_logs | comparison | 10 | Oom killed | Debug Dashboard |
| quality_gate_metrics_logs | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_metrics_logs | comparison | 10 | Oom killed | Debug Dashboard |
| quality_gate_security_idle | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_security_no_fs_load | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_security_no_fs_load | comparison | 10 | Oom killed | Debug Dashboard |
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
rhy988
force-pushed
the
ralph/alp-log-querying-benchmark
branch
2 times, most recently
from
July 2, 2026 18:13
9f3fe88 to
771e05a
Compare
Add exclude_at_match_ottl and include_at_match_ottl processing rule types that evaluate OTTL conditions against JSON log attributes using the opentelemetry-collector-contrib ottllog context. (cherry picked from commit 278db0a)
Introduces two new processing rule types backed by github.com/DataDog/fastjq: - `exclude_at_jq_match`: drops log lines for which the jq expression produces output - `include_at_jq_match`: keeps only log lines for which the jq expression produces output Non-JSON content is passed through unchanged for both rule types. Compile once per rule at startup (fastjq.Compile); filter closure holds a reused buffer so core operations remain zero-alloc at steady state. (cherry picked from commit 487a58f)
… CI builds opentelemetry-collector-contrib/internal/coreinternal@v0.155.0 added timeutils/strptime_cgo_testlib.go to support one of its own unit tests, but the file isn't named _test.go and has no test-only build constraint (just `cgo && unix`), so it compiles into any production build that imports timeutils with cgo enabled on unix — including cmd/agent, now that OTTL's condition parser pulls this package in transitively. It fails specifically on this repo's x64 Linux CI build image (`tm.tm_gmtoff undefined`); arm64 is unaffected, and PR #51988 (pinned to the older v0.153.0, before this file existed) never hit it. local-patches/opentelemetry-collector-contrib-coreinternal is an unmodified copy of the real v0.155.0 source with only that one file's build tag changed so it's never compiled — no version change, no functional difference, just removing a mistagged test helper from production builds.
get_module_by_path() returns None for any module registered as `ignored` in modules.yml (vendored/local-patch copies of third-party code, testdata dirs, etc.), but the caller unconditionally called .should_test() on the result. This only surfaced now because no previous ignored module had real, frequently-modified .go files in it — the local-patches/opentelemetry-collector-contrib-coreinternal patch added in the previous commit is the first to trigger it.
local-patches/opentelemetry-collector-contrib-coreinternal was long enough that several already-long upstream paths under it (e.g. goldendataset/testdata/generated_pict_pairs_metrics.txt) exceeded the repo's Windows-install-path-length budget. Renamed to otel-patches/coreinternal (no functional change).
…mparison Adds 3 SMP regression experiments (logs_filter_baseline, logs_filter_ottl, logs_filter_jq) that benchmark the standard regex-based log filtering against OTTL and jq alternatives, using a shared synthetic JSON log stream (templated_json, weighted equally across the three implementations' name field) so results are comparable in the same time window. Each case differs only in its log_processing_rules entry: - baseline: include_at_match on the raw "name":"baseline" substring - ottl: include_at_match_ottl with attributes["name"] == "ottl" - jq: include_at_jq_match with select(.name == "jq")
Regenerates go.mod/go.sum across affected modules following the rebase onto current main, replacing the two now-stale tidy passes from the prior base.
rhy988
force-pushed
the
ralph/alp-log-querying-benchmark
branch
from
July 6, 2026 00:43
69a8629 to
ce4a5ce
Compare
…lation logs_filter_baseline/ottl/jq all crash on every replicate with a lading config parse error, even though the baseline case uses no OTTL/jq code. This case swaps the custom templated_json lading generator for the built-in apache_common variant (same one quality_gate_logs already uses successfully) with a permissive match-everything filter, to check whether the crash is specific to the templated_json config path.
…tering cases The logs_filter_baseline/ottl/jq cases crashed on every replicate because the templated_json lading variant requires an external template file (/etc/lading/templated_json.yaml) that the SMP execution path does not deliver to the lading container, so lading exited non-zero at startup. Switch all three cases to lading's built-in `json` variant (no external file) and filter on the built-in `seed` field (~50% selectivity) using each engine's idiom: regex "seed":\d*[02468], / OTTL attributes["seed"] < 32768 / jq select(.seed < 32768). Each case now processes the identical stream and keeps ~half, keeping the per-engine CPU comparison fair. Also removes the logs_filter_diag_apache crash-isolation case, which confirmed the crash was specific to the templated_json path.
…g-benchmark # Conflicts: # comp/core/agenttelemetry/fx/go.sum # comp/core/agenttelemetry/impl/go.sum # comp/logs-library/go.sum # comp/otelcol/collector-contrib/impl/go.sum # comp/otelcol/ddflareextension/impl/go.sum # comp/otelcol/logsagentpipeline/go.sum # comp/otelcol/logsagentpipeline/logsagentpipelineimpl/go.sum # comp/otelcol/otlp/components/exporter/datadogexporter/go.sum # comp/otelcol/otlp/components/exporter/logsagentexporter/go.sum # comp/otelcol/otlp/components/exporter/serializerexporter/go.sum # go.sum # internal/qbranch/anomalydetection-testbench/go.sum # test/otel/go.mod # test/otel/go.sum
rhy988
force-pushed
the
ralph/alp-log-querying-benchmark
branch
from
July 6, 2026 21:23
d9fc2b8 to
fa521b6
Compare
Contributor
Author
|
Superseded by #53809 — VRL's blockers (empty function table, missing tests) have since been fixed, so this benchmark now combines all 3 engines (regex baseline, OTTL, jq, VRL) in one branch/PR instead of dropping VRL. Closing this one in favor of the new PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds 3 SMP experiment cases to benchmark the performance of different log filtering rule implementations against the standard Datadog log filtering baseline:
All 3 implementations live on the same branch (ralph/alp-log-querying-benchmark) and are bundled into a single agent image. Each case applies the same filtering logic and is run against the same synthetic JSON log workload generated by a custom log generator (JSON logs with a name field set to ottl/jq/baseline), with only the active filter method differing per case.
Update: VRL has been dropped from this benchmark. It was originally included as a 4th candidate, but was removed after investigation surfaced two blockers:
compilerfeature, notstdlib— meaning none of VRL's standard library functions (parse_json,contains, etc.) were actually available, so it couldn't do JSON-field-aware filtering at all. Enablingstdlib/stdlib-basehits an unresolved Bazel/Cargo toolchain gap (native C build scripts in some of VRL's dependencies fail to compile under this repo's hermetic LLVM toolchain).VRL can be revisited later once the underlying Bazel/Rust toolchain issue is resolved; the original
ralph/alp-vrl-log-processingbranch is untouched.Motivation
We are evaluating which log filtering implementation to adopt as a replacement or complement to the current regex-based processing rules. OTTL and jq each offer better ergonomics for structured/JSON logs than regex, but have different performance profiles.
Running all 3 cases in a single SMP job is a deliberate design choice: because they share the same job, they run on the same machine in the same time window, making their CPU and memory metrics directly comparable on the dashboard without any time series alignment. Running them as separate jobs would introduce timing drift between runs, making fair comparison unreliable.
Describe how you validated your changes
Before running the full SMP experiment, a local functional smoke test was run to verify that each implementation correctly filters logs:
Additional Notes