How to know whether an event is a log or a metric?

[nzxwang]

Hi team,

Some of vector's transform components only work for a specific event subtype. For example, throttle only works for logs and tag_cardinality_limit only works for metrics. This makes sense because vector logs are a structured representation of a point-in-time event, and vector metrics are not represented as structured logs.

However, it seems like when a component receives an incompatible event subtype it will drop it silently. Moreover, vector tap will print metrics as a structured log. This makes it difficult to observe what is happening when an event is being dropped because of subtype. What is the best way to know whether an event flowing through a vector topoology is a log or a metric?

Thank you

[jszwedko]

This seems like it'd be a useful enhancement to add to vector tap when the --meta flag is used. It could be added to this file: https://github.com/vectordotdev/vector/blob/master/lib/vector-tap/src/lib.rs

Without that, I'm not sure there is a good way to differentiate between a log that happens to match the structure of a metric and an actual metric.

[nzxwang]

Thanks Jesse. I'll make a feature request referencing your comment here. Hopefully I'll be able to convince my team to let me tackle this one (:

[nzxwang]

Referencing your comment in the feature request didn't link it here so linking it: #21224