more

internal/normalization/normalizer.go

@@ -26,6 +26,13 @@ type Event struct {
 	Service           string  `json:"service"`
 	Release           string  `json:"release,omitempty"`
 	Environment       string  `json:"environment,omitempty"`
+	Method            string  `json:"method,omitempty"`
+	Host              string  `json:"host,omitempty"`
+	UserAgent         string  `json:"userAgent,omitempty"`
+	OriginHost        string  `json:"originHost,omitempty"`
+	RefererHost       string  `json:"refererHost,omitempty"`
+	FetchSite         string  `json:"fetchSite,omitempty"`
+	FetchMode         string  `json:"fetchMode,omitempty"`
 	Kind              string  `json:"kind"`
 	Source            string  `json:"source"`
 	IsError           bool    `json:"isError"`
@@ -108,7 +115,7 @@ func normalizeTraces(ingest int64, envelope map[string]json.RawMessage) []Event
 				if exceptionType != "" && message != "" {
 					message = exceptionType + ": " + message
 				}
-				isError := status == 2 || statusCode >= 400 || intAttr(attrs, "rpc.grpc.status_code") > 0 || exceptionType != ""
+				isError := status == 2 || isErrorStatus(statusCode) || intAttr(attrs, "rpc.grpc.status_code") > 0 || exceptionType != ""
 				e := baseEvent(ingest, attrs, "span", item.TraceID)
 				e.IsError, e.StatusCode, e.StatusClass = isError, statusCode, statusClass(statusCode)
 				e.DurationMS = durationMS(item.Start, item.End)
@@ -140,7 +147,7 @@ func normalizeLogs(ingest int64, envelope map[string]json.RawMessage) []Event {
 				statusCode := intAttr(attrs, "http.response.status_code", "http.status_code")
 				grpcCode := intAttr(attrs, "rpc.grpc.status_code")
 				e := baseEvent(timestampOr(ingest, item.Timestamp), attrs, "log", item.TraceID)
-				e.IsError = item.SeverityNumber >= 17 || strings.EqualFold(item.SeverityText, "ERROR") || strings.EqualFold(item.SeverityText, "FATAL") || exceptionType != "" || statusCode >= 400 || grpcCode > 0
+				e.IsError = item.SeverityNumber >= 17 || strings.EqualFold(item.SeverityText, "ERROR") || strings.EqualFold(item.SeverityText, "FATAL") || exceptionType != "" || isErrorStatus(statusCode) || grpcCode > 0
 				e.StatusCode, e.StatusClass = statusCode, statusClass(statusCode)
 				e.Route, e.ExceptionType, e.MessageNormalized, e.StackSignature = normalizeHTTPRoute(attrs), exceptionType, normalizeMessage(message), firstFrame(stack)
 				e.IsRetry, e.IsTimeout, e.IsCancellation = operationFlags(attrs, statusCode, grpcCode)
@@ -301,7 +308,28 @@ func baseEvent(timestamp int64, attrs []attribute, kind, traceID string) Event {
 	if source == "" {
 		source = "backend"
 	}
-	return Event{Timestamp: timestamp, NormalizerVersion: Version, Service: defaultString(stringAttr(attrs, "service.name"), "unknown"), Release: stringAttr(attrs, "service.release"), Environment: defaultString(stringAttr(attrs, "deployment.environment.name", "deployment.environment", "service.environment"), ""), Kind: kind, Source: source, TraceID: traceID}
+	ep := httpattr.Extract(func(keys ...string) string { return stringAttr(attrs, keys...) })
+	return Event{
+		Timestamp: timestamp, NormalizerVersion: Version,
+		Service:     defaultString(stringAttr(attrs, "service.name"), "unknown"),
+		Release:     stringAttr(attrs, "service.release"),
+		Environment: defaultString(stringAttr(attrs, "deployment.environment.name", "deployment.environment", "service.environment"), ""),
+		Method:      ep.Method, Host: ep.Host,
+		UserAgent:   stringAttr(attrs, "http.user_agent", "user_agent.original"),
+		OriginHost:  attrHost(stringAttr(attrs, "http.request.header.origin", "http.origin", "origin")),
+		RefererHost: attrHost(stringAttr(attrs, "http.request.header.referer", "http.referer")),
+		FetchSite:   stringAttr(attrs, "http.request.header.sec_fetch_site"),
+		FetchMode:   stringAttr(attrs, "http.request.header.sec_fetch_mode"),
+		Kind:        kind, Source: source, TraceID: traceID,
+	}
+}
+
+func attrHost(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	host, _ := httpattr.SplitURL(raw)
+	return host
 }
 func finish(e Event) Event {
 	if e.IsError {
@@ -445,3 +473,10 @@ func exception(events []spanEvent) (string, string, string) {
 	}
 	return "", "", ""
 }
+
+// isErrorStatus reports whether an HTTP status alone marks an event as an
+// error. 404/410 are excluded: missing resources and scanner probes would
+// otherwise dominate the error rate the spike label is built from.
+func isErrorStatus(code int) bool {
+	return code >= 400 && code != 404 && code != 410
+}