Skip to content

feat(ocsf): carry structured events on sandbox log stream - #3104

Open
krishicks wants to merge 1 commit into
hicks/push-onytvlvvyoxsfrom
hicks/push-vlqrkupqqkrp
Open

feat(ocsf): carry structured events on sandbox log stream#3104
krishicks wants to merge 1 commit into
hicks/push-onytvlvvyoxsfrom
hicks/push-vlqrkupqqkrp

Conversation

@krishicks

@krishicks krishicks commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Carry each sandbox OCSF event as JSON alongside the log line so the gateway and downstream exporters retain the complete event instead of reparsing shorthand text.

Render display text from the decoded event at the gateway. Preserve the original message when a line has no structured payload or the payload cannot be decoded.

Related Issue

#1055

Changes

Testing

  • mise run pre-commit passes
  • Unit tests added/updated
  • E2E tests added/updated (if applicable)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (if applicable)

@krishicks
feat(ocsf): carry structured events on sandbox log stream
5637ae7 
Carry each sandbox OCSF event as JSON alongside the log line so the gateway and
downstream exporters retain the complete event instead of reparsing shorthand
text.

Render display text from the decoded event at the gateway. Preserve the
original message when a line has no structured payload or the payload cannot be
decoded.

Refs #1055

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@johntmyers

johntmyers commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Review findings

  • [P1] Preserve the fallback message for mixed-version gateways. For OCSF events, LogPushLayer now sets message to an empty string and carries the content only in the new ocsf_json protobuf field (log_push.rs:54-91). A pre-feat(ocsf): carry structured events on sandbox log stream #3104 gateway ignores unknown field 8 and publishes the empty fallback, so OCSF entries appear blank when a newer supervisor reconnects to an older gateway during a rollout or rollback. Supervisor images can be pinned independently, so this mixed-version pairing is supported and realistic. Please keep message populated with the shorthand representation and treat ocsf_json as additive metadata, or negotiate support before clearing the fallback.

  • [P2] Expose the structured payload through the curated Go SDK. The protobuf gains ocsf_json, but types.LogLine has no corresponding field (types/log.go:9-21) and LogLineFromProto does not copy GetOcsfJson() (converter/log.go:18-25). Exporters using the curated API therefore still cannot retain the complete event. Please add a deep-copied byte field or parsed OCSF representation and converter coverage.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@sjenning sjenning Awaiting requested review from sjenning sjenning is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@krishicks @johntmyers