feat: Update Vault Audit parser to use LoggingReceiverMacro

apps/vault.go

@@ -19,7 +19,6 @@ import (
 	"fmt"
 
 	"github.com/GoogleCloudPlatform/ops-agent/confgenerator"
-	"github.com/GoogleCloudPlatform/ops-agent/confgenerator/fluentbit"
 	"github.com/GoogleCloudPlatform/ops-agent/confgenerator/otel"
 	"github.com/GoogleCloudPlatform/ops-agent/internal/secret"
 )
@@ -312,44 +311,37 @@ func init() {
 	confgenerator.MetricsReceiverTypes.RegisterType(func() confgenerator.MetricsReceiver { return &MetricsReceiverVault{} })
 }
 
-type LoggingProcessorVaultJson struct {
-	confgenerator.ConfigComponent `yaml:",inline"`
-}
+type LoggingProcessorMacroVaultJson struct{}
 
-func (LoggingProcessorVaultJson) Type() string {
+func (LoggingProcessorMacroVaultJson) Type() string {
 	return "vault_audit"
 }
 
-func (p LoggingProcessorVaultJson) Components(ctx context.Context, tag, uid string) []fluentbit.Component {
-	c := []fluentbit.Component{}
-
-	// sample log line:
-	// {"time":"2022-06-07T20:34:34.392078404Z","type":"request","auth":{"token_type":"default"},"request":{"id":"aa005196-0280-381d-ebeb-1a083bdf5675","operation":"update","namespace":{"id":"root"},"path":"sys/audit/test"}}
-	jsonParser := &confgenerator.LoggingProcessorParseJson{
-		ParserShared: confgenerator.ParserShared{
-			TimeKey:    "time",
-			TimeFormat: "%Y-%m-%dT%H:%M:%S.%L%z",
-		},
-	}
-
-	c = append(c,
+func (p LoggingProcessorMacroVaultJson) Expand(ctx context.Context) []confgenerator.InternalLoggingProcessor {
+	return []confgenerator.InternalLoggingProcessor{
 		confgenerator.LoggingProcessorModifyFields{
 			Fields: map[string]*confgenerator.ModifyField{
 				InstrumentationSourceLabel: instrumentationSourceValue(p.Type()),
 			},
-		}.Components(ctx, tag, uid)...,
-	)
-	c = append(c, jsonParser.Components(ctx, tag, uid)...)
-	return c
+		},
+		// sample log line:
+		// {"time":"2022-06-07T20:34:34.392078404Z","type":"request","auth":{"token_type":"default"},"request":{"id":"aa005196-0280-381d-ebeb-1a083bdf5675","operation":"update","namespace":{"id":"root"},"path":"sys/audit/test"}}
+		confgenerator.LoggingProcessorParseJson{
+			ParserShared: confgenerator.ParserShared{
+				TimeKey:    "time",
+				TimeFormat: "%Y-%m-%dT%H:%M:%S.%L%z",
+			},
+		},
+	}
 }
 
-type LoggingReceiverVaultAuditJson struct {
-	LoggingProcessorVaultJson `yaml:",inline"`
-	ReceiverMixin             confgenerator.LoggingReceiverFilesMixin `yaml:",inline"`
-	IncludePaths              []string                                `yaml:"include_paths,omitempty" validate:"required"`
+type LoggingReceiverMacroVaultAuditJson struct {
+	LoggingProcessorMacroVaultJson `yaml:",inline"`
+	ReceiverMixin                  confgenerator.LoggingReceiverFilesMixin `yaml:",inline"`
+	IncludePaths                   []string                                `yaml:"include_paths,omitempty" validate:"required"`
 }
 
-func (r LoggingReceiverVaultAuditJson) Components(ctx context.Context, tag string) []fluentbit.Component {
+func (r LoggingReceiverMacroVaultAuditJson) Expand(ctx context.Context) (confgenerator.InternalLoggingReceiver, []confgenerator.InternalLoggingProcessor) {
 	r.ReceiverMixin.IncludePaths = r.IncludePaths
 
 	r.ReceiverMixin.MultilineRules = []confgenerator.MultilineRule{
@@ -365,10 +357,10 @@ func (r LoggingReceiverVaultAuditJson) Components(ctx context.Context, tag strin
 		},
 	}
 
-	c := r.ReceiverMixin.Components(ctx, tag)
-	return append(c, r.LoggingProcessorVaultJson.Components(ctx, tag, r.LoggingProcessorVaultJson.Type())...)
+	return &r.ReceiverMixin, r.LoggingProcessorMacroVaultJson.Expand(ctx)
 }
 
 func init() {
-	confgenerator.LoggingReceiverTypes.RegisterType(func() confgenerator.LoggingReceiver { return &LoggingReceiverVaultAuditJson{} })
+	confgenerator.RegisterLoggingReceiverMacro(func() LoggingReceiverMacroVaultAuditJson { return LoggingReceiverMacroVaultAuditJson{} })
+	confgenerator.RegisterLoggingProcessorMacro[LoggingProcessorMacroVaultJson]()
 }

transformation_test/testdata/logging_processor-vault-audit/config.yaml

@@ -0,0 +1 @@
+- type: vault_audit

transformation_test/testdata/logging_processor-vault-audit/input.log

@@ -0,0 +1,47 @@
+{"time":"2025-08-25T14:00:00.123456789Z","type":"request","auth":{"token_type":"default"},"request":{"id":"req-001","operation":"update","namespace":{"id":"root"},"path":"sys/audit/test"}}
+{
+  "time":"2025-08-25T14:01:00.987654321Z",
+  "type":"request",
+  "auth":{
+    "token_type":"root"
+  },
+  "request":{
+    "id":"req-002",
+    "operation":"delete",
+    "namespace":{
+      "id":"root"
+    },
+    "path":"sys/secrets/data"
+  }
+}
+{"time":"2025-08-25T14:02:00.111213141Z","type":"response","auth":{"token_type":"default"},"response":{"id":"res-001","status":"success"}}
+{
+  "time":"2025-08-25T14:03:00.999888777Z",
+  "type":"response",
+  "auth":{
+    "token_type":"default"
+  },
+  "response":{
+    "id":"res-002",
+    "status":"failure",
+    "error":"permission denied"
+  }
+}
+{"time":"2025-08-25T14:04:00.222333444Z","type":"request","auth":{"token_type":"default"},"request":{"id":"req-003","operation":"create","namespace":{"id":"root"},"path":"sys/audit/new"}}
+{
+  "time":"2025-08-25T14:05:00.555666777Z",
+  "type":"request",
+  "auth":{
+    "token_type":"default"
+  },
+  "request":{
+    "id":"req-004",
+    "operation":"update",
+    "namespace":{
+    "id":"root"
+    },
+    "path":"sys/audit/multi"
+   }
+}
+{"time":"2025-08-25T15:02:00.111213141Z","type":"response","auth":{"token_type":"default"},"response":{"id":"res-001","status":"success"}}
+{"time":"2025-08-25T16:04:00.222333444Z","type":"request","auth":{"token_type":"default"},"request":{"id":"req-003","operation":"create","namespace":{"id":"root"},"path":"sys/audit/new"}}