Host Observer: Add OmitPIDDimension config option (#1517)

Author: benkeith-splunk

docs/observers/host.md

@@ -18,6 +18,7 @@ Observer Type: `host`
 
 | Config option | Required | Type | Description |
 | --- | --- | --- | --- |
+| `omitPIDDimension` | no | `bool` | If `true`, the `pid` dimension will be omitted from the generated endpoints, which means it will not appear on datapoints emitted by monitors instantiated from discovery rules matching this endpoint. (**default:** `false`) |
 | `pollIntervalSeconds` | no | `integer` |  (**default:** `10`) |
 
 

pkg/observers/host/host.go

@@ -47,7 +47,11 @@ type Observer struct {
 // Config specific to the host observer
 type Config struct {
 	config.ObserverConfig
-	PollIntervalSeconds int `default:"10" yaml:"pollIntervalSeconds"`
+	// If `true`, the `pid` dimension will be omitted from the generated
+	// endpoints, which means it will not appear on datapoints emitted by
+	// monitors instantiated from discovery rules matching this endpoint.
+	OmitPIDDimension    bool `default:"false" yaml:"omitPIDDimension"`
+	PollIntervalSeconds int  `default:"10" yaml:"pollIntervalSeconds"`
 }
 
 func init() {
@@ -138,8 +142,9 @@ func (o *Observer) discover() []services.Endpoint {
 			continue
 		}
 
-		dims := map[string]string{
-			"pid": strconv.Itoa(int(pid)),
+		dims := map[string]string{}
+		if !o.config.OmitPIDDimension {
+			dims["pid"] = strconv.Itoa(int(pid))
 		}
 
 		for _, c := range conns {

pkg/observers/host/host_test.go

@@ -105,6 +105,23 @@ func Test_HostObserver(t *testing.T) {
 		}
 	}
 
+	t.Run("Omit PID", func(t *testing.T) {
+		config.OmitPIDDimension = true
+		defer func() { config.OmitPIDDimension = false }()
+		tcpConns := openTestTCPPorts(t)
+		startObserver()
+		lock.Lock()
+		require.True(t, len(endpoints) >= len(tcpConns))
+
+		for _, e := range endpoints {
+			_, ok := e.Dimensions()["pid"]
+			require.False(t, ok)
+		}
+
+		lock.Unlock()
+		o.Shutdown()
+	})
+
 	t.Run("Basic connections", func(t *testing.T) {
 		tcpConns := openTestTCPPorts(t)
 		udpConns := openTestUDPPorts(t)
@@ -130,6 +147,9 @@ func Test_HostObserver(t *testing.T) {
 				} else {
 					require.Equal(t, e.DerivedFields()["is_ipv6"], false)
 				}
+
+				_, ok := e.Dimensions()["pid"]
+				require.True(t, ok)
 			}
 		})
 
@@ -151,6 +171,9 @@ func Test_HostObserver(t *testing.T) {
 				} else {
 					require.Equal(t, e.DerivedFields()["is_ipv6"], false)
 				}
+
+				_, ok := e.Dimensions()["pid"]
+				require.True(t, ok)
 			}
 		})
 

selfdescribe.json

@@ -56127,6 +56127,14 @@
       "doc": " Looks at the current host for listening network endpoints.\nIt uses the `/proc` filesystem and requires the `SYS_PTRACE` and\n`DAC_READ_SEARCH` capabilities so that it can determine what processes own\nthe listening sockets.\n\nIt will look for all listening sockets on TCP and UDP over IPv4 and IPv6.\n",
       "package": "pkg/observers/host",
       "fields": [
+        {
+          "yamlName": "omitPIDDimension",
+          "doc": "If `true`, the `pid` dimension will be omitted from the generated endpoints, which means it will not appear on datapoints emitted by monitors instantiated from discovery rules matching this endpoint.",
+          "default": false,
+          "required": false,
+          "type": "bool",
+          "elementKind": ""
+        },
         {
           "yamlName": "pollIntervalSeconds",
           "doc": "",