略過剖析器擴充功能和自訂剖析器的記錄驗證

支援語言：

自訂剖析器和剖析器擴充功能的驗證程序通常會對前 30 天的範例記錄檔進行嚴格檢查，確保功能完整性。不過，在某些情況下，即使驗證失敗，客戶可能仍需部署擴充功能，例如過去 30 天內未擷取任何記錄，或目前的記錄尚未反映新格式。

本文將說明以 API 為基礎的工作流程，略過剖析器擴充功能和自訂剖析器的強制記錄驗證。

元件 定義
API 方法 CreateParserExtension (適用於擴充功能) 或 CreateParser (適用於自訂剖析器)
略過標記 validation_skipped
旗標類型 布林值 (預設值：false)
範圍 ParserExtension Proto (適用於擴充功能) 和 Parser Proto (適用於自訂剖析器)

略過驗證後，剖析器會顯示 validation_skipped 狀態。由於這是非同步作業，因此對 Create API 的初始呼叫會顯示新狀態。不過，後續的 Get API 要求會在處理完畢後反映 validation_skipped 狀態。

API 執行

執行相關的 Create API 呼叫，並啟用 validation_skipped 旗標。即使系統完全沒有為客戶和記錄類型擷取任何記錄，您仍可使用這個標記，啟用自訂剖析器或擴充功能。

剖析器擴充功能的 API 範例

  • 「CreateParserExtension」要求

    parent:    "projects/dummy/locations/us/instances/dummy/logTypes/dummy"
parser_extension {
  cbn_snippet: "# Author:dummy@google.com\n# Note: Pls don\'t delete or update.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
  validation_skipped: true
}

  • CreateParserExtension 回覆

    google.cloud.chronicle.v1main.ParserExtension { # [619B]
name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy"
state: NEW
create_time: { # [12B]
seconds: 1775133417
nanos: 697098000
}
cbn_snippet: "# Author:dummy@google.com\n# Note: Pls don\'t delete or update.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
extension_validation_report:
"projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy/extensionValidationReports/dummy"
validation_skipped: true
}

  • 「GetParserExtension」要求

    name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy"

  • GetParserExtension 回覆

    google.cloud.chronicle.v1main.ParserExtension { # [862B]
name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy"
state: VALIDATION_SKIPPED
create_time: { # [12B]
seconds: 1775133417
nanos: 697098000
}
cbn_snippet: "# Author:dummy@google.com\n# Note: Pls don\'t delete or update.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
extension_validation_report: 
"projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy/extensionValidationReports/dummy"
validation_report:"projects/dummy/locations/us/instances/dummy/logTypes/dummy/parserExtensions/dummy/validationReports/dummy"
state_last_changed_time: { # [12B]
seconds: 1775133417
nanos: 976250000
}
last_live_time: { # [11B]
seconds: 1775133418
nanos: 189172000
}
validation_skipped: true
}

建立剖析器擴充功能後，您可以使用 ActivateParserExtension 方法部署這些擴充功能。

自訂剖析器的 API 範例

  • 「CreateParser」要求

    parent: "projects/dummy/locations/us/instances/dummy/logTypes/dummy"
parser: { # [260B]
cbn: "# Author: dummy@google.com\n# Note: Pls don\'t delete or update. This is used by normalizer custom prober.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
validation_skipped: true
}

  • CreateParser 回覆

    google.cloud.chronicle.v1main.Parser { # [489B]
name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parsers/dummy"
creator: { # [85B]
customer:"projects/dummy/locations/us/instances/dummy"
source: CUSTOMER
}
cbn: "# Author: dummy@google.com\n# Note: Pls don\'t delete or update. This is used by normalizer custom prober.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
changelogs: { # [0B]
}
validation_stage: NEW
type: CUSTOM
state: INACTIVE
validation_skipped: true
}

  • 「GetParser」要求

    name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parsers/dummy"

  • GetParser 回覆

    name: "projects/dummy/locations/us/instances/dummy/logTypes/dummy/parsers/dummy"
creator: { # [85B]
customer:"projects/dummy/locations/us/instances/dummy"
source: CUSTOMER
}
cbn: "# Author:dummy@google.com\n# Note: Pls don\'t delete or update. This is used by normalizer custom prober.\n\nfilter {\n  mutate {\n    convert => {\n      \"message\" => \"integer\"\n    }\n  }\n   mutate {\n    merge => {\n      \"@output\" => \"event\"\n    }\n  }\n}"
create_time: { # [12B]
seconds: 1775135466
nanos: 795092000
}
changelogs: { # [0B]
}
validation_stage: VALIDATION_SKIPPED
type: CUSTOM
state: INACTIVE
validation_report:"projects/dummy/locations/us/instances/dummy/logTypes/dummy/parsers/dummy/validationReports/dummy"

建立自訂剖析器後，您可以使用 ActivateParser 方法部署。

拒絕條件和風險

  • validation_skipped 標記可讓使用者略過對樣本記錄的檢查，但無法部署損毀的程式碼。 如果擴充功能或剖析器程式碼含有語法相關的失敗，擴充功能或自訂剖析器仍會遭到拒絕。只有在擴充功能語法正確，但因剖析邏輯或缺少記錄而失敗時，才能選擇略過。

  • 如果 validation_skipped 標記導致系統問題或效能回歸，Google 內部工程團隊可能會停用該標記。

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求解答。