LOG-6296: GCP expects certain severity value strings

internal/generator/vector/output/gcl/gcl.go

@@ -2,6 +2,7 @@ package gcl
 
 import (
 	"fmt"
+
 	"github.com/openshift/cluster-logging-operator/internal/api/observability"
 
 	obs "github.com/openshift/cluster-logging-operator/api/observability/v1"
@@ -76,21 +77,24 @@ func New(id string, o obs.OutputSpec, inputs []string, secrets observability.Sec
 		return []Element{}
 	}
 	componentID := vectorhelpers.MakeID(id, "log_id")
+	gclSeverityID := vectorhelpers.MakeID(id, "normalize_severity")
 	g := o.GoogleCloudLogging
 	gcl := &GoogleCloudLogging{
 		ComponentID:     id,
-		Inputs:          helpers.MakeInputs(componentID),
+		Inputs:          helpers.MakeInputs(gclSeverityID),
 		LogDestination:  LogDestination(g),
 		LogID:           componentID,
 		SeverityKey:     SeverityKey(g),
 		CredentialsPath: auth(g.Authentication, secrets),
 		RootMixin:       common.NewRootMixin(nil),
 	}
+
 	if strategy != nil {
 		strategy.VisitSink(gcl)
 	}
 	return []Element{
 		commontemplate.TemplateRemap(componentID, inputs, o.GoogleCloudLogging.LogId, componentID, "GoogleCloudLogging LogId"),
+		NormalizeSeverity(gclSeverityID, []string{componentID}),
 		gcl,
 		common.NewEncoding(id, ""),
 		common.NewAcknowledgments(id, strategy),
@@ -127,3 +131,29 @@ func LogDestination(g *obs.GoogleCloudLogging) Element {
 func SeverityKey(g *obs.GoogleCloudLogging) string {
 	return DefaultSeverityKey
 }
+
+// NormalizeSeverity normalizes log severity to conform to GCL's standard
+// Accepted Severity: DEFAULT, EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG
+// Ref: https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logseverity
+func NormalizeSeverity(componentID string, inputs []string) Element {
+	var vrl = `
+# Set audit log level to 'INFO'
+if .log_type == "audit" {
+	.level = "INFO"
+} else if !exists(.level) {
+  	.level = "DEFAULT"
+} else if .level == "warn" {
+	.level = "WARNING"
+} else if .level == "trace" {
+	.level = "DEBUG"
+} else {
+	.level = upcase!(.level) 
+}
+`
+	return Remap{
+		Desc:        "Normalize GCL severity levels",
+		ComponentID: componentID,
+		Inputs:      vectorhelpers.MakeInputs(inputs...),
+		VRL:         vrl,
+	}
+}

internal/generator/vector/output/gcl/gcl_with_custom_logid.toml

@@ -6,9 +6,28 @@ source = '''
 ._internal.gcl_1_log_id = "my-id" + to_string!(.log_type||"none")
 '''
 
+# Normalize GCL severity levels
+[transforms.gcl_1_normalize_severity]
+type = "remap"
+inputs = ["gcl_1_log_id"]
+source = '''
+# Set audit log level to 'INFO'
+if .log_type == "audit" {
+	.level = "INFO"
+} else if !exists(.level) {
+  	.level = "DEFAULT"
+} else if .level == "warn" {
+	.level = "WARNING"
+} else if .level == "trace" {
+	.level = "DEBUG"
+} else {
+	.level = upcase!(.level) 
+}
+'''
+
 [sinks.gcl_1]
 type = "gcp_stackdriver_logs"
-inputs = ["gcl_1_log_id"]
+inputs = ["gcl_1_normalize_severity"]
 billing_account_id = "billing-1"
 credentials_path = "/var/run/ocp-collector/secrets/gcl-1/google-application-credentials.json"
 log_id = "{{ _internal.gcl_1_log_id }}"

internal/generator/vector/output/gcl/gcl_with_tls.toml

@@ -6,9 +6,28 @@ source = '''
 ._internal.gcl_1_log_id = "vector-1"
 '''
 
+# Normalize GCL severity levels
+[transforms.gcl_1_normalize_severity]
+type = "remap"
+inputs = ["gcl_1_log_id"]
+source = '''
+# Set audit log level to 'INFO'
+if .log_type == "audit" {
+	.level = "INFO"
+} else if !exists(.level) {
+  	.level = "DEFAULT"
+} else if .level == "warn" {
+	.level = "WARNING"
+} else if .level == "trace" {
+	.level = "DEBUG"
+} else {
+	.level = upcase!(.level) 
+}
+'''
+
 [sinks.gcl_1]
 type = "gcp_stackdriver_logs"
-inputs = ["gcl_1_log_id"]
+inputs = ["gcl_1_normalize_severity"]
 billing_account_id = "billing-1"
 credentials_path = "/var/run/ocp-collector/secrets/gcl-1/google-application-credentials.json"
 log_id = "{{ _internal.gcl_1_log_id }}"

internal/generator/vector/output/gcl/gcl_with_token.toml

@@ -6,9 +6,28 @@ source = '''
 ._internal.gcl_1_log_id = "vector-1"
 '''
 
+# Normalize GCL severity levels
+[transforms.gcl_1_normalize_severity]
+type = "remap"
+inputs = ["gcl_1_log_id"]
+source = '''
+# Set audit log level to 'INFO'
+if .log_type == "audit" {
+	.level = "INFO"
+} else if !exists(.level) {
+  	.level = "DEFAULT"
+} else if .level == "warn" {
+	.level = "WARNING"
+} else if .level == "trace" {
+	.level = "DEBUG"
+} else {
+	.level = upcase!(.level) 
+}
+'''
+
 [sinks.gcl_1]
 type = "gcp_stackdriver_logs"
-inputs = ["gcl_1_log_id"]
+inputs = ["gcl_1_normalize_severity"]
 billing_account_id = "billing-1"
 credentials_path = "/var/run/ocp-collector/secrets/gcl-1/google-application-credentials.json"
 log_id = "{{ _internal.gcl_1_log_id }}"

internal/generator/vector/output/gcl/gcl_with_tuning.toml

@@ -6,9 +6,28 @@ source = '''
 ._internal.gcl_1_log_id = "vector-1"
 '''
 
+# Normalize GCL severity levels
+[transforms.gcl_1_normalize_severity]
+type = "remap"
+inputs = ["gcl_1_log_id"]
+source = '''
+# Set audit log level to 'INFO'
+if .log_type == "audit" {
+	.level = "INFO"
+} else if !exists(.level) {
+  	.level = "DEFAULT"
+} else if .level == "warn" {
+	.level = "WARNING"
+} else if .level == "trace" {
+	.level = "DEBUG"
+} else {
+	.level = upcase!(.level) 
+}
+'''
+
 [sinks.gcl_1]
 type = "gcp_stackdriver_logs"
-inputs = ["gcl_1_log_id"]
+inputs = ["gcl_1_normalize_severity"]
 billing_account_id = "billing-1"
 credentials_path = "/var/run/ocp-collector/secrets/gcl-1/google-application-credentials.json"
 log_id = "{{ _internal.gcl_1_log_id }}"