otel

Documentation

Overview

Package otel maps an OTLP log record emitted by an endpoint agent's live telemetry into numbat's normalized model.Event. It is the OTel-sensor analog of internal/hook: where the hook package turns a per-agent lifecycle JSON payload into an Event, this package turns an OTLP/HTTP LogRecord (plus its Resource attributes) into the same flat Event the on-disk extractors produce, so the shared pipeline detects on a telemetry event exactly as it does on an artifact or a hook event.

Two honesty constraints — identical to the hook path — shape the mapping:

• source_type is always "otel". A telemetry event is a live observation pushed over OTLP, not a parse of a durable on-disk artifact, and downstream consumers must be able to tell the two apart.
• Evidence is deliberately thin. An OTLP record carries no artifact path, line number, rowid, or content hash — there is no on-disk record to point back to — so Evidence holds only the synthetic artifact type ("otel"), with no path, line, rowid, or hash. Fabricating one here would forge forensic provenance, so we do not.

Mapping uses OpenTelemetry GenAI conventions plus exact documented aliases for agents that still emit private event names. Records with no normalized analog return Mapped=false instead of receiving a guessed event type.

Index

• type MapResult
  • func MapRecords(b []byte, idFor func(int) string) ([]MapResult, error)

Types

type MapResult

type MapResult struct {
	Event  model.Event
	Mapped bool
	// SourceAgent is the agent the record's service.name resolved to, returned
	// even for a skipped record so the caller can label a skip diagnostic.
	SourceAgent string
}

MapResult is the outcome of mapping one OTLP record. Mapped is true when the record classified onto an existing event_type; when false the record had no analog in numbat's vocabulary and the caller skips it (see Map). Event is meaningful only when Mapped is true.

func MapRecords

func MapRecords(b []byte, idFor func(int) string) ([]MapResult, error)

MapRecords flattens a decoded OTLP logs request into per-record map results, pairing each LogRecord with its emitting Resource's attributes and assigning a stable event id from idFor(index). The caller (the receiver) feeds each mapped event through the shared pipeline and skips the rest.