Using processor/filter to drop/keep spans depending on span name

[JasmineCA]

Component(s)

processor/filter

Describe the issue you're reporting

Hello everyone,

I started to use opentelemetry collector to duplicate and re-route spans from different sources to different backends. So we started to ask ourselves how to filter our spans. We decided we will first route spans with their name, which is not a resource attribute, so we could not use the routing connector. Instead, we went for the processor/filter.

However, the rule "keep this span if name matches xxx" translates into "drop this span if name does not match xxx" with filter. And it is difficult when you add span names. Here is the current configuration of the filter:

processors:
  filter:
    error_mode: ignore
    traces:
      span:
        - (not IsMatch(name, ".*/foo")) or (not IsMatch(name,".*/bar))

We can also put a single IsMatch and a regex containing all the span names we want to keep, but maybe there is a better solution? In filter there is some include/exclude, but based on resource attributes, which is not possible for span name. Or maybe another processor I didn't stubble into? Do you have a better syntax/solution or do you plan to add this feature to processor/filter?

Thank you!

[github-actions]

Pinging code owners:

• processor/filter: @TylerHelmuth @boostchicken

%s See Adding Labels via Comments if you do not have permissions to add labels yourself.

[TylerHelmuth]

This feels closely related to #30420, where the user wants to check if a value is in a list. Short answer is "yes, we want to add that feature".

Also in that issue is the idea of handling the not logic implicitly, kinda like the deprecated filterprocessor configuration's include option, although I'd use a word like keep instead of include.

While we wait on those features, in your specific use case, you could take advantage of regex to shorten the OTTL statement:

not IsMatch(name, ".*/(foo|bar)")

If your actual regexes are more complex than that you could do a single not:

processors:
  filter:
    error_mode: ignore
    traces:
      span:
        - |
          not (
            IsMatch(name, ".*/foo") or
            IsMatch(name,".*/bar)
          )

[JasmineCA]

Thank you for your reply. The issue you mentioned is indeed really close to my usecase. I will keep an eye on it. In the meantime, I used regex because I feel it will be more efficient than multiple OTTL statements (correct me if I'm wrong). My regexs are not very complex, only simple string or ".*/foo" like regex.

[TylerHelmuth]

OTTL is very efficient, but a simple regex will fit your needs best.

[JasmineCA]

I'm more concerned about maintainability because now I have like 6 or 7 regexps and I'm not sure if it's very readable

[TylerHelmuth]

Ultimately we need the Contains converter mentioned in #30420. Until then, whether you do 1 big regex or multiple calls to IsMatch is up to you.

[JasmineCA]

Yes, this feature would be the best. From my point of view, I feel easier to manage multiple IsMatch calls in the configuration file. I will keep it this way until the Contains feature is released

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

• processor/filter: @TylerHelmuth @boostchicken

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[github-actions]

This issue has been closed as inactive because it has been stale for 120 days with no activity.