From 4ccb09d2f466d260b682926991c3ed1c9784bbfb Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Mon, 14 Nov 2022 17:00:36 -0500 Subject: [PATCH] aws-s3 - Disable event normalization processing Disable event normalization for the aws-s3 input to reduce allocations when processing events. The input only produces basic types in its events. Either it puts a string into the `message` field or it decodes json into a map[string]interface with encoding/json. Both of those should be fine for the downstream processors and outputs. Relates #33657 --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/input/awss3/input.go | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 141906bd163..e2864f16b16 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -157,6 +157,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff] - Improve httpjson documentation for split processor. {pull}33473[33473] - Added separation of transform context object inside httpjson. Introduced new clause `.parent_last_response.*` {pull}33499[33499] - Cloud Foundry input uses server-side filtering when retrieving logs. {pull}33456[33456] +- Disable "event normalization" processing for the aws-s3 input to reduce allocations. {pull}33673[33673] *Auditbeat* diff --git a/x-pack/filebeat/input/awss3/input.go b/x-pack/filebeat/input/awss3/input.go index e93ff421693..b76df41deea 100644 --- a/x-pack/filebeat/input/awss3/input.go +++ b/x-pack/filebeat/input/awss3/input.go @@ -112,6 +112,11 @@ func (in *s3Input) Run(inputContext v2.Context, pipeline beat.Pipeline) error { client, err := pipeline.ConnectWith(beat.ClientConfig{ CloseRef: inputContext.Cancelation, ACKHandler: awscommon.NewEventACKHandler(), + Processing: beat.ProcessingConfig{ + // This input only produces events with basic types so normalization + // is not required. + EventNormalization: boolPtr(false), + }, }) if err != nil { return fmt.Errorf("failed to create pipeline client: %w", err) @@ -368,3 +373,6 @@ func getProviderFromDomain(endpoint string, ProviderOverride string) string { } return "unknown" } + +// boolPtr returns a pointer to b. +func boolPtr(b bool) *bool { return &b }