more

internal/normalization/normalizer.go

@@ -26,6 +26,13 @@ type Event struct {
 	Service           string  `json:"service"`
 	Release           string  `json:"release,omitempty"`
 	Environment       string  `json:"environment,omitempty"`
+	Method            string  `json:"method,omitempty"`
+	Host              string  `json:"host,omitempty"`
+	UserAgent         string  `json:"userAgent,omitempty"`
+	OriginHost        string  `json:"originHost,omitempty"`
+	RefererHost       string  `json:"refererHost,omitempty"`
+	FetchSite         string  `json:"fetchSite,omitempty"`
+	FetchMode         string  `json:"fetchMode,omitempty"`
 	Kind              string  `json:"kind"`
 	Source            string  `json:"source"`
 	IsError           bool    `json:"isError"`
@@ -108,7 +115,7 @@ func normalizeTraces(ingest int64, envelope map[string]json.RawMessage) []Event
 				if exceptionType != "" && message != "" {
 					message = exceptionType + ": " + message
 				}
-				isError := status == 2 || statusCode >= 400 || intAttr(attrs, "rpc.grpc.status_code") > 0 || exceptionType != ""
+				isError := status == 2 || isErrorStatus(statusCode) || intAttr(attrs, "rpc.grpc.status_code") > 0 || exceptionType != ""
 				e := baseEvent(ingest, attrs, "span", item.TraceID)
 				e.IsError, e.StatusCode, e.StatusClass = isError, statusCode, statusClass(statusCode)
 				e.DurationMS = durationMS(item.Start, item.End)
@@ -140,7 +147,7 @@ func normalizeLogs(ingest int64, envelope map[string]json.RawMessage) []Event {
 				statusCode := intAttr(attrs, "http.response.status_code", "http.status_code")
 				grpcCode := intAttr(attrs, "rpc.grpc.status_code")
 				e := baseEvent(timestampOr(ingest, item.Timestamp), attrs, "log", item.TraceID)
-				e.IsError = item.SeverityNumber >= 17 || strings.EqualFold(item.SeverityText, "ERROR") || strings.EqualFold(item.SeverityText, "FATAL") || exceptionType != "" || statusCode >= 400 || grpcCode > 0
+				e.IsError = item.SeverityNumber >= 17 || strings.EqualFold(item.SeverityText, "ERROR") || strings.EqualFold(item.SeverityText, "FATAL") || exceptionType != "" || isErrorStatus(statusCode) || grpcCode > 0
 				e.StatusCode, e.StatusClass = statusCode, statusClass(statusCode)
 				e.Route, e.ExceptionType, e.MessageNormalized, e.StackSignature = normalizeHTTPRoute(attrs), exceptionType, normalizeMessage(message), firstFrame(stack)
 				e.IsRetry, e.IsTimeout, e.IsCancellation = operationFlags(attrs, statusCode, grpcCode)
@@ -301,7 +308,28 @@ func baseEvent(timestamp int64, attrs []attribute, kind, traceID string) Event {
 	if source == "" {
 		source = "backend"
 	}
-	return Event{Timestamp: timestamp, NormalizerVersion: Version, Service: defaultString(stringAttr(attrs, "service.name"), "unknown"), Release: stringAttr(attrs, "service.release"), Environment: defaultString(stringAttr(attrs, "deployment.environment.name", "deployment.environment", "service.environment"), ""), Kind: kind, Source: source, TraceID: traceID}
+	ep := httpattr.Extract(func(keys ...string) string { return stringAttr(attrs, keys...) })
+	return Event{
+		Timestamp: timestamp, NormalizerVersion: Version,
+		Service:     defaultString(stringAttr(attrs, "service.name"), "unknown"),
+		Release:     stringAttr(attrs, "service.release"),
+		Environment: defaultString(stringAttr(attrs, "deployment.environment.name", "deployment.environment", "service.environment"), ""),
+		Method:      ep.Method, Host: ep.Host,
+		UserAgent:   stringAttr(attrs, "http.user_agent", "user_agent.original"),
+		OriginHost:  attrHost(stringAttr(attrs, "http.request.header.origin", "http.origin", "origin")),
+		RefererHost: attrHost(stringAttr(attrs, "http.request.header.referer", "http.referer")),
+		FetchSite:   stringAttr(attrs, "http.request.header.sec_fetch_site"),
+		FetchMode:   stringAttr(attrs, "http.request.header.sec_fetch_mode"),
+		Kind:        kind, Source: source, TraceID: traceID,
+	}
+}
+
+func attrHost(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	host, _ := httpattr.SplitURL(raw)
+	return host
 }
 func finish(e Event) Event {
 	if e.IsError {
@@ -445,3 +473,10 @@ func exception(events []spanEvent) (string, string, string) {
 	}
 	return "", "", ""
 }
+
+// isErrorStatus reports whether an HTTP status alone marks an event as an
+// error. 404/410 are excluded: missing resources and scanner probes would
+// otherwise dominate the error rate the spike label is built from.
+func isErrorStatus(code int) bool {
+	return code >= 400 && code != 404 && code != 410
+}

internal/normalization/normalizer_test.go

@@ -106,3 +106,29 @@ func TestNormalizeHTTPRoutePrefersSpecificPathOverRootMount(t *testing.T) {
 		t.Fatalf("expected specific URL path, got %q", events[0].Route)
 	}
 }
+
+func TestNormalizeHTTPRequestMetadataIsSafeAndNormalized(t *testing.T) {
+	data := []byte(`{"resourceSpans":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"preview"}}]},"scopeSpans":[{"spans":[{"traceId":"trace-1","name":"GET /","attributes":[{"key":"http.method","value":{"stringValue":"GET"}},{"key":"http.host","value":{"stringValue":"preview.example.test:443"}},{"key":"http.target","value":{"stringValue":"/"}},{"key":"http.user_agent","value":{"stringValue":"Chrome"}},{"key":"http.request.header.origin","value":{"stringValue":"https://app.example.test"}},{"key":"http.request.header.referer","value":{"stringValue":"https://app.example.test/dashboard?secret=1"}},{"key":"http.request.header.sec_fetch_site","value":{"stringValue":"same-origin"}},{"key":"http.request.header.sec_fetch_mode","value":{"stringValue":"navigate"}}]}]}]}]}`)
+	events, err := NormalizeEntry("traces", 99, data)
+	if err != nil || len(events) != 1 {
+		t.Fatalf("normalize failed: %v %+v", err, events)
+	}
+	event := events[0]
+	if event.Method != "GET" || event.Host != "preview.example.test" || event.UserAgent != "Chrome" {
+		t.Fatalf("unexpected request metadata: %+v", event)
+	}
+	if event.OriginHost != "app.example.test" || event.RefererHost != "app.example.test" {
+		t.Fatalf("request metadata must retain hosts without paths: %+v", event)
+	}
+	if event.FetchSite != "same-origin" || event.FetchMode != "navigate" {
+		t.Fatalf("missing fetch metadata: %+v", event)
+	}
+}
+
+func TestIsErrorStatusIgnoresMissingResources(t *testing.T) {
+	for code, want := range map[int]bool{200: false, 404: false, 410: false, 401: true, 500: true} {
+		if got := isErrorStatus(code); got != want {
+			t.Errorf("isErrorStatus(%d) = %v, want %v", code, got, want)
+		}
+	}
+}