Auto Multiline v2 - Add Legacy Regex Support

[gh123man]

What does this PR do?

Adds support for custom regex patterns in auto multiline aggregation V2.
When the new feature is enabled, custom patterns configured by auto_multi_line_extra_patterns will be converted to auto_multi_line_detection_custom_samples to maintain backwards compatibility.

Going forward regex patterns should instead be configured with auto_multi_line_detection_custom_samples as it supports the ability to optionally customize the label. This allows the use of regex for not only signaling the start of a multi line log, but also matching patterns that should never be aggregated, or patterns that should be included in a multiline log.

Motivation

Describe how to test/QA your changes

1. Enable the feature and add a regex rule

logs_config:
    experimental_auto_multi_line_detection: true
    auto_multi_line_detection_custom_samples:
    - regex: "\\[\\w+\\] Datadog"

2. Emit some logs that match the pattern and start the agent:

[info] Datadog agent - some log message
[info] Datadog agent - some log message
[info] Datadog agent - some log message
[error] Datadog agent - some log message
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
[info] Datadog agent - some log message
[error] Datadog agent - some log message
[info] Datadog agent - some log message
[warn] Datadog agent - some log message
[info] Datadog agent - some log message
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
 oh no a stack trace!
[warn] Datadog agent - some log message
[warn] Datadog agent - some log message
[warn] Datadog agent - some log message
[warn] Datadog agent - some log message
[warn] Datadog agent - some log message

3. Run agent status -v and the output for your source should look like this:

 - ID: /Users/brian.floersch/scratch/logs/sample.log
      Type: file  
      24h Moving Sum (bytes): 869   
      Auto multiline pattern stats:
        14          aggregate       default               CC CC C CCCCC CCCCC!
        13          start_group     user_sample          [CCCC] CCCCCCC CCCCC - CCCC CCC CCCCCCC  

Note start_group user_sample for the lines that matched.

4. Update your agent config

logs_config:
    experimental_auto_multi_line_detection: true
    auto_multi_line_extra_patterns:
    - "\\[\\w+\\] Datadog"

5. Run steps 2-3 again.

6. Update the agent config:

logs_config:
    experimental_auto_multi_line_detection: true
    auto_multi_line_detection_custom_samples:
    - regex: "\\[\\w+\\] Datadog"
      label: no_aggregate

Run steps 2-3 again, except in step 3 note that the log should be no_aggregate instead of user_sample.

Possible Drawbacks / Trade-offs

Additional Notes

[pr-commenter]

Test changes on VM

Use this command from test-infra-definitions to manually test this PR changes on a VM:

inv create-vm --pipeline-id=45155262 --os-family=ubuntu

Note: This applies to commit e9d4fa7

[pr-commenter]

Regression Detector

Regression Detector Results

Run ID: a04f98c-7878-480a-b4ab-acb93c16b708 Metrics dashboard Target profiles

Baseline: c5bcbc1
Comparison: e9d4fa7

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

No significant changes in experiment optimization goals

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	uds_dogstatsd_to_api_cpu	% cpu utilization	+2.36	[+1.62, +3.11]	1	Logs
➖	tcp_syslog_to_blackhole	ingress throughput	+1.54	[+1.50, +1.59]	1	Logs
➖	pycheck_lots_of_tags	% cpu utilization	+0.56	[-2.06, +3.18]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	+0.00	[-0.08, +0.08]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.01, +0.01]	1	Logs
➖	otel_to_otel_logs	ingress throughput	-0.05	[-0.85, +0.76]	1	Logs
➖	basic_py_check	% cpu utilization	-0.12	[-2.90, +2.67]	1	Logs
➖	idle	memory utilization	-0.42	[-0.47, -0.38]	1	Logs
➖	file_tree	memory utilization	-0.64	[-0.73, -0.56]	1	Logs

Bounds Checks

perf	experiment	bounds_check_name	replicates_passed
✅	idle	memory_usage	10/10

Explanation

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

3. Its configuration does not mark it "erratic".

[gh123man]

/merge

[dd-devflow]

🚂 MergeQueue: pull request added to the queue

The median merge time in main is 23m.

Use /merge -c to cancel this operation!