Skip to content

Add OTLP/gRPC output driver - #316

Open
andborja wants to merge 3 commits into
cea-sec:mainfrom
andborja:andborja/OtlpDriver
Open

andborja wants to merge 3 commits into
cea-sec:mainfrom
andborja:andborja/OtlpDriver

Conversation

@andborja

@andborja andborja commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds a new otlp output driver that exports received Windows events to an OpenTelemetry (OTLP) endpoint over gRPC. Each event is mapped to an OpenTelemetry log record — the event content becomes the log body, and subscription/client information is attached as attributes.

Details

Event mapping: The event content is set as the log body. Windows event Level and TimeCreated are best-effort parsed from the raw event XML to populate the record's severity and timestamp; when absent or unparseable, severity falls back to INFO and the timestamp falls back to openwec's receive time.

Attributes:

  • subscription.name
  • subscription.uuid
  • client
  • client.address
  • node (when available)

Configuration (OtlpConfiguration):

  • endpoint — OTLP/gRPC endpoint (required)
  • timeout — optional export timeout in seconds (1–300)
  • compression — optional, gzip or zstd

Delivery semantics

Export runs inline in write() on the server's Tokio runtime, so failures propagate back to openwec and the batch is retried.

Testing

Added unit tests covering:

  • Driver construction with valid config and gzip/zstd compression
  • Level → OpenTelemetry Severity mapping and fallback for missing/unknown/non-numeric levels
  • TimeCreated extraction (single/double quotes) and None on missing/invalid timestamps

@andborja

Copy link
Copy Markdown
Contributor Author

@vruello, @WilliamBruneau, hopefully you can review this PR is the project is active

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant