Commit Graph
11 Commits
Author SHA1 Message Date
HuaijinandHengfei Yang 61c5826199 chore: code cleanup and add trace_id in logs (#11385)
Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com>
2026-04-22 16:20:32 +00:00
416a6cce32 feat: work group v2 — slot-based admission (#10990)
## Summary

Design at:
https://github.com/openobserve/designs/blob/main/infrastructure/work-group/work_group_v2_impl.md

This PR adds slot-based distributed admission control for search queries
and fixes file dispatch consistency when a subset of querier nodes is
selected per query.

To enable this feature we need to set:

```
O2_WORK_GROUP_MAX_NODES_PER_QUERY > 0
O2_WORK_GROUP_NODE_SELECTION_STRATEGY = org | stream
```

### Slot-based admission

- Add `TryAcquire / StartQuery / ReleaseQuery` gRPC RPCs — Follow nodes
reserve slots before execution starts and self-release via
`FlightEncoderStream::drop`
- Wire slot admission in both Arrow Flight search and PromQL paths,
co-located with the existing org/user concurrency queue check
- Delegate DataFusion `target_partitions` / `memory_size` to enterprise
`get_resource_limit()`, which applies per-query slot fraction with
optional dynamic expansion
- TTL sweep interval derived from `slot_reserved_ttl_ms / 4` (min 100
ms) instead of a hardcoded 500 ms
- Move `QUERY_PENDING_NUMS` / `QUERY_RUNNING_NUMS` metric updates to
after slot admission completes (a blocked request is no longer counted
as "running")

### Consistent-hash file dispatch fix (`max_nodes_per_query > 0`)

- Add `get_node_from_consistent_hash_within(key, role, group, allowed)`
to `infra::cluster`: walks the global ring clockwise from `hash(key)`
but skips nodes outside `allowed`. Preserves all consistent-hash
properties (even distribution via vnodes, minimal remapping on
membership change) while confining dispatch to the selected subset
- `partition_file_by_hash` now passes only the selected querier nodes as
the `allowed` set, so every file maps to one of the N selected nodes —
no more fallback-to-index-0 imbalance when `strategy=org/stream`
- File-list broadcast (enterprise) pre-computes per-item target nodes
using the same filtered ring walk via `broadcast_item_targets()` in
`o2-enterprise`, so broadcast and dispatch always agree on which node
owns each file

### Proto fix

- Reserve field 10 in `QueryStatus` (was `WorkGroup` enum / varint wire
type) and move `work_group` string to field 13 — prevents wire-type
mismatch during rolling upgrades

### Other fixes from code review

- `get_first_stream_key()` now returns `"{stream_type}/"` sentinel
instead of `""` for multi-stream / cross-index queries, so
`select_nodes` always receives a non-empty deterministic key
- PromQL node selection uses `"metrics/"` stream key (consistent with
the sentinel format) instead of bare `"metrics"`
- Move `_orig_trace_id` binding inside `#[cfg(feature = "enterprise")]`
block in `FlightEncoderStream::drop`

## Key config (all default to safe/off values)

| Env var | Default | Description |
|---|---|---|
| `O2_WORK_GROUP_MAX_NODES_PER_QUERY` | `0` | Nodes per query; 0 = all
nodes (disables slot admission) |
| `O2_WORK_GROUP_NODE_SELECTION_STRATEGY` | `all` | `all` / `org` /
`stream` |
| `O2_WORK_GROUP_SHORT_SLOT_RATIO` | `0.8` | Max fraction of node slots
for short queries |
| `O2_WORK_GROUP_DYNAMIC_RESOURCE` | `true` | Expand DataFusion
allocation on idle nodes |

## Test plan

- [x] Default (`max_nodes_per_query=0`): behavior identical to before,
zero overhead
- [x] `strategy=org`, `max_nodes_per_query=3`, 10-node cluster: each org
consistently uses the same 3 nodes; files distributed evenly across
those 3 nodes (no node-0 pile-up)
- [x] Broadcast routes each file to the same node that
`partition_file_by_hash` selects at query time → cache hits on
re-queries
- [x] Slot admission: 3rd request waits when budget=2 and 2 queries
running; slots released on completion
- [x] PromQL queries respect slot budget
- [x] Rolling upgrade: old node sends `QueryStatus` without field 10
conflict

## Related

Requires companion PR in `o2-enterprise`:
https://github.com/openobserve/o2-enterprise/pull/1378

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-05 05:31:37 +00:00
Subhra264 90a279134b feat: introduce rbac for logs patterns, logs insights and cache refresh (#10662) 2026-03-01 16:20:10 +08:00
Hengfei Yang bdefdde66c fix: migration router (#10058) 2026-01-16 16:36:04 +08:00
Hengfei Yang 62f5def1be feat: add MCP category annotations to API endpoints (#9937) 2026-01-15 17:05:43 +08:00
Hengfei Yang 33eecaefe3 refactor: migrate actix-web to axum (#9912) 2026-01-13 16:44:53 +08:00
Hengfei Yang ec021ac29e perf: optimize MCP tools - reduce size from 643KB to 123KB (#9825) 2026-01-03 14:47:15 +08:00
sktrpathiandsai nikhil kethe e52d000217 feat: add incident correlation system (#9507)
## Summary

Introduces comprehensive incident management system to reduce alert
fatigue through intelligent correlation and AI-powered root cause
analysis.

**Design at:**
https://github.com/openobserve/designs/tree/main/alert-correlation

---

## Incident Correlation

**3-Tier Correlation Priority:**
1. **Trace-based**: Groups alerts from same distributed trace
(cross-service)
2. **Service Discovery**: Uses semantic service matching with
normalization
3. **Dimension-based**: Blake3 hash from stable alert dimensions
(fallback)

**Features:**
- Automatic alert grouping into incidents
- Real-time incident status tracking
(open/acknowledged/resolved/suppressed)
- Topology enrichment via Service Graph integration
- Cross-environment correlation prevention via dimension matching

## Incident Analysis (RCA)

**Automated Analysis:**
- Background job queries open incidents and triggers AI agent
- Periodic analysis via configurable interval
- Results displayed in incident detail view with markdown support

**On-Demand Analysis:**
- Manual trigger via API: `POST /api/v2/{org}/alerts/incidents/{id}/rca`
- Real-time results with loading indicators
- One-click "Analyze" button in UI

## SRE Chat Assistant

**Conversational AI for Alerts:**
- Generic `/api/{org}/agent/chat` endpoint with history support
- Context-aware assistance for alerts and incidents
- Sparkle icons on alert/incident rows for quick access
- Persistent chat history via IndexedDB
- Includes RCA analysis in conversation context

---

## Configuration

```bash
# Incident Management
O2_INCIDENTS_AUTO_RESOLVE_AFTER_MINUTES=-1  # -1=disabled (default), >0=auto-resolve

# RCA Agent Integration
O2_INCIDENTS_RCA_ENABLED=true
O2_INCIDENTS_RCA_AGENT_URL=http://localhost:8000
O2_INCIDENTS_RCA_INTERVAL_SECS=600
```

## API Endpoints

- `GET /api/v2/{org}/alerts/incidents` - List incidents with pagination
- `GET /api/v2/{org}/alerts/incidents/{id}` - Get incident details
- `PATCH /api/v2/{org}/alerts/incidents/{id}` - Update incident status
- `GET /api/v2/{org}/alerts/incidents/stats` - Get incident statistics
- `POST /api/v2/{org}/alerts/incidents/{id}/rca` - Trigger RCA analysis
- `POST /api/{org}/agent/chat` - Generic agent chat endpoint
- `POST /api/{org}/agent/chat/stream` - Streaming agent chat

## Database

- **New tables**: `alert_incidents`, `alert_incident_alerts`
- **Migration**: `m20251204_000001_create_alert_incidents_table`
- **ORM**: SeaORM entities with full CRUD support

## UI Components

- **IncidentList.vue**: Status filtering, pagination, statistics
dashboard
- **IncidentDetailDrawer.vue**: Full incident view with
triggers/alerts/analysis
- **SREChat.vue**: AI assistant panel with markdown rendering
- Incidents tab in AlertList with unified view
- AI sparkle icons for contextual chat access

---

## Enterprise Feature

This is an **enterprise-only** feature with OSS stubs for compilation
compatibility.

- Non-enterprise builds: Handlers return `403 Forbidden`
- Enterprise builds: Full functionality enabled

## Test Plan

- [x] Build passes without `--features enterprise`
- [x] Build passes with `--features enterprise`
- [x] Create alerts that fire and verify incidents are created
- [x] Verify incident list/detail APIs work correctly
- [x] Verify status updates (open → acknowledged → resolved)
- [x] Verify correlation logic (trace-based, service discovery,
dimension-based)
- [x] Verify RCA analysis triggers and displays correctly
- [x] Verify SRE chat integration with alert/incident context

---------

Co-authored-by: sai nikhil kethe <nikhil@openobserve.ai>
2025-12-12 22:14:18 +05:30
Ashish Kolheandgithub-actions[bot] 0b4e66c8f6 feat: sampling for search apis and patterns (#9207)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-11-28 16:13:04 +05:30
ByteBaker 1593db0e22 feat: skip aud validation for MCP-invoked requests
- Add `x-o2-mcp` header support for MCP request identification in token validator
- Wrap OpenAPI schema types with `inline()` for better documentation generation
- Update AI module imports to use new agent namespace
- fix compilation for `cloud` feature, also return early if user isn't in trial
- Enable service graph by default
2025-11-04 17:36:23 +05:30
Ashish Kolheandomkark06 196512057c feat: log patterns (#8927)
PR introduces below features:

- [x] Reporting triggers to source org
- [x] Alerts Insights for detailed visibility in alerts  

 
Enterprise features:

- [x] Patterns extraction during query - UI and API
- [x] Patterns extraction as part of ingestion process (No Sampling
today)
- [x] Settings to enable pattern extraction

---------

Co-authored-by: omkark06 <omkar@zinclabs.io>
2025-11-04 11:19:39 +05:30