绕过解析器扩展程序和自定义解析器的日志验证

支持：

自定义解析器和解析器扩展程序验证流程通常会针对过去 30 天的示例日志执行严格检查，以确保功能完整性。不过，在某些情况下，客户可能需要在验证失败时部署扩展程序，例如过去 30 天内未提取任何日志，或者当前日志尚未反映新格式。

本文档简要介绍了基于 API 的工作流，用于绕过解析器扩展程序和自定义解析器的强制日志验证。

组件 定义
API 方法 CreateParserExtension（适用于扩展程序）或 CreateParser（适用于自定义解析器）
绕过标志 validation_skipped
标志类型 布尔值（默认值：false）
范围 ParserExtension proto（适用于扩展程序）和 Parser proto（适用于自定义解析器）

跳过验证后，解析器会显示为 validation_skipped 状态。由于这是异步操作，因此对 Create API 的初始调用将显示新状态。不过，后续的 Get API 请求在处理后会反映 validation_skipped 状态。

API 执行

执行相关的 Create API 调用，并启用 validation_skipped 标志。即使客户和日志类型根本没有提取任何日志，您也可以使用此标志并使自定义解析器或扩展程序处于活跃状态。

解析器扩展程序的 API 示例

  • CreateParserExtension 请求

    parent:    "projects/dummy/locations/us/instances/dummy/logTypes/dummy"
parser_extension {
  cbn_snippet: "# Author:dummy@google.com\n# Note: Pls don\'t delete or update.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
  validation_skipped: true
}

  • CreateParserExtension 响应

    google.cloud.chronicle.v1main.ParserExtension { # [619B]
name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy"
state: NEW
create_time: { # [12B]
seconds: 1775133417
nanos: 697098000
}
cbn_snippet: "# Author:dummy@google.com\n# Note: Pls don\'t delete or update.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
extension_validation_report:
"projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy/extensionValidationReports/dummy"
validation_skipped: true
}

  • GetParserExtension 请求

    name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy"

  • GetParserExtension 响应

    google.cloud.chronicle.v1main.ParserExtension { # [862B]
name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy"
state: VALIDATION_SKIPPED
create_time: { # [12B]
seconds: 1775133417
nanos: 697098000
}
cbn_snippet: "# Author:dummy@google.com\n# Note: Pls don\'t delete or update.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
extension_validation_report: 
"projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy/extensionValidationReports/dummy"
validation_report:"projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy/validationReports/dummy"
state_last_changed_time: { # [12B]
seconds: 1775133417
nanos: 976250000
}
last_live_time: { # [11B]
seconds: 1775133418
nanos: 189172000
}
validation_skipped: true
}

创建解析器扩展程序后，您可以使用 ActivateParserExtension 方法部署它们。

自定义解析器的 API 示例

  • CreateParser 请求

    parent: "projects/dummy/locations/us/instances/dummy/logTypes/dummy"
parser: { # [260B]
cbn: "# Author: dummy@google.com\n# Note: Pls don\'t delete or update. This is used by normalizer custom prober.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
validation_skipped: true
}

  • CreateParser 响应

    google.cloud.chronicle.v1main.Parser { # [489B]
name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parsers/dummy"
creator: { # [85B]
customer:"projects/dummy/locations/us/instances/dummy"
source: CUSTOMER
}
cbn: "# Author: dummy@google.com\n# Note: Pls don\'t delete or update. This is used by normalizer custom prober.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
changelogs: { # [0B]
}
validation_stage: NEW
type: CUSTOM
state: INACTIVE
validation_skipped: true
}

  • GetParser 请求

    name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parsers/dummy"

  • GetParser 响应

    name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parsers/dummy"
creator: { # [85B]
customer:"projects/dummy/locations/us/instances/dummy"
source: CUSTOMER
}
cbn: "# Author:dummy@google.com\n# Note: Pls don\'t delete or update. This is used by normalizer custom prober.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
create_time: { # [12B]
seconds: 1775135466
nanos: 795092000
}
changelogs: { # [0B]
}
validation_stage: VALIDATION_SKIPPED
type: CUSTOM
state: INACTIVE
validation_report:"projects/dummy/locations/us/instances/dummy/logTypes/dummy/parsers/dummy/validationReports/dummy"

创建自定义解析器后，您可以使用 ActivateParser 方法部署它们。

拒绝条件和风险

  • 虽然 validation_skipped 标志允许用户绕过针对示例日志的检查，但它不允许部署损坏的代码。 如果扩展程序或解析器代码包含与语法相关的失败，扩展程序或自定义解析器仍会被拒绝。只有当扩展程序在语法上正确，但由于解析逻辑或缺少日志而失败时，跳过选项才可行。

  • 如果 validation_skipped 标志导致系统问题或性能回归，Google 内部工程团队可能会停用该标志。

需要更多帮助？获得社区成员和 Google SecOps 专业人士的解答。