Skip to content

[AWSINTS-3563] refactor(go-forwarder)#1114

Merged
ndakkoune merged 6 commits into
nabil.dakkoune/go-forwarderfrom
nabil.dakkoune/AWSINTS-3563
Apr 27, 2026
Merged

[AWSINTS-3563] refactor(go-forwarder)#1114
ndakkoune merged 6 commits into
nabil.dakkoune/go-forwarderfrom
nabil.dakkoune/AWSINTS-3563

Conversation

@ndakkoune
Copy link
Copy Markdown
Contributor

@ndakkoune ndakkoune commented Apr 24, 2026

What does this PR do?

Refactors names, adds lazy loading and recent go features

Motivation

Testing Guidelines

Additional Notes

  • Unified log entry model and introduced a shared LogEntry type. S3LogEntry is a now a plain LogEntry.
  • Added sync.Once-based S3 client caching and client caching to leverage warm invocations.
  • Renamed model types for clarity:
    • MetadataLambdaOrigin
    • CloudwatchLogsContextCloudwatchOrigin
    • S3ContextS3Origin
  • Refactored Cloudwatch handler
  • Introduced constant names for log groups, log streams and s3 keys.
  • Replaced HasPrefix+ manual slicing with strings.CutPrefix.
  • Increased maxTokenSize from 512KB to ~1MB.
  • Renamed files:
    • parsing.go → invocation_source.go
    • cloudwatchlogs.go → cloudwatch.go
    • metadata.go → lambda_origin.go
  • Improved tests by replacing context.Background() to t.Context() across all test file, defer server.Close() /
    defer cancel() to t.Cleanup() and added missing t.Parallel().
  • Rewrote batching tests as table-driven.

Types of changes

  • Bug fix
  • New feature
  • Breaking change
  • Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

  • This PR's description is comprehensive
  • This PR contains breaking changes that are documented in the description
  • This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
  • This PR impacts documentation, and it has been updated (or a ticket has been logged)
  • This PR's changes are covered by the automated tests
  • This PR collects user input/sensitive content into Datadog
  • This PR passes the integration tests (ask a Datadog member to run the tests)
  • This PR passes the unit tests
  • This PR passes the installation tests (ask a Datadog member to run the tests)

@github-actions github-actions Bot added the aws label Apr 24, 2026
@ndakkoune ndakkoune marked this pull request as ready for review April 24, 2026 14:52
@ndakkoune ndakkoune requested a review from a team as a code owner April 24, 2026 14:52
@ndakkoune ndakkoune requested review from ViBiOh and ge0Aja April 24, 2026 15:32
batches := make(chan []byte)

batcher := processing.NewBatcher[T]()
forwarder := forwarding.NewForwarder(cfg, &http.Client{
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure why you created the client within forwading and didn't pass it here directly ? is it used somewhere else ?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I passed it to the Forwarder struct to make testing easier. The forwarding.Client is an http.Client which is initialized when the lambda cold starts and is reused across invocations.

@ge0Aja ge0Aja self-assigned this Apr 27, 2026
var jsonMessage map[string]any
if err := json.Unmarshal([]byte(message), &jsonMessage); err != nil {
return nil, service, message
return
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please let's not use this syntax it's confusing. What's your motivation here ?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wasn't sure if it was idiomatic to use returned parameters here. I agree that the initial newMessage = message makes it difficult to read and I'll revert that.

Comment thread aws/logs_monitoring_go/internal/parsing/scanner.go
GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error)
}

func getS3APIClient(ctx context.Context, useFIPS bool) (S3APIClient, error) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if you're calling this once already, why would you need a once here ? I saw a single call for createS3APIClient

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doing so makes us lazy load the AWS SDK client and reuse it across lambda invocations.

func newS3EntryBase(record events.S3EventRecord, cfg *config.Config, lambdaOrigin model.LambdaOrigin) s3EntryBase {
bucket := record.S3.Bucket.Name
key := record.S3.Object.URLDecodedKey
source := cmp.Or(cfg.Source, getS3Source(key))
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are you sure you want to use cmp.Or here ?

Or returns the first of its arguments that is not equal to the zero value. If no argument is non-zero, it returns the zero value.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The overriden source (configured through the DD_SOURCE env var) has the higher priority, so whenever it is configured it will be used. Otherwise we fallback to the key extraction.

@ndakkoune ndakkoune merged commit 1feb74f into nabil.dakkoune/go-forwarder Apr 27, 2026
10 checks passed
@ndakkoune ndakkoune deleted the nabil.dakkoune/AWSINTS-3563 branch April 27, 2026 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants