feat(correlation): emit A events filtered by include_dest_ports to ClickHouse (v1.1.16)
Some checks failed
Build and Test / test (push) Has been cancelled
Build and Test / build (push) Has been cancelled
Build and Test / docker (push) Has been cancelled

When an A event (HTTP) was excluded by the include_dest_ports filter, it was
silently dropped and never reached ClickHouse. With ApacheAlwaysEmit=true, the
event is now returned immediately as an uncorrelated log (orphan_side=A).
B events on filtered ports continue to be dropped (no useful data).

Updated TestCorrelationService_IncludeDestPorts_FilteredPort to assert the A
event is emitted with Correlated=false, OrphanSide=A.
Added TestCorrelationService_IncludeDestPorts_FilteredPort_NoAlwaysEmit to
confirm silent drop when ApacheAlwaysEmit=false.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
toto
2026-03-06 08:39:12 +01:00
parent b47f4258fd
commit f0b74f45a3
4 changed files with 51 additions and 7 deletions

View File

@ -145,6 +145,14 @@ exit 0
%config(noreplace) /etc/logrotate.d/logcorrelator
%changelog
* Fri Mar 06 2026 logcorrelator <dev@example.com> - 1.1.16-1
- Feat(correlation): emettre les evenements A filtrés par include_dest_ports vers ClickHouse
Quand un evenement A (HTTP) etait exclu par le filtre include_dest_ports, il etait
silencieusement ignore. Desormais, si ApacheAlwaysEmit=true, l evenement est emis comme
non-correle (orphan_side=A) afin d apparaitre dans ClickHouse. Les evenements B restent
ignores. Test: TestCorrelationService_IncludeDestPorts_FilteredPort mis a jour +
TestCorrelationService_IncludeDestPorts_FilteredPort_NoAlwaysEmit ajoute.
* Thu Mar 05 2026 logcorrelator <dev@example.com> - 1.1.15-1
- Fix(correlation/bug3): perte de donnees quand B expire avec des orphelins en attente
cleanNetworkBufferByTTL supprimait les pendingOrphans sans les emettre (perte silencieuse).