[Epic] log_to_metric polishing

[spencergilbert]

Summary:

The log_to_metric transform continues to be a strong option for users wanting to reduce and control costs while still surfacing useful information in a more cost efficient way. However, the current UX of the transform is lacking and frequently raised as a point of confusion or overly verbose configuration.

A recent example of redundant tagging configuration:

I have to add the tags for each metric I extract, where it would be useful to have the tags added for all metrics extracted in the block.

[transforms.elb_to_metric]
type = "log_to_metric"
inputs = [ "split_on_status.ok" ]

  [[transforms.elb_to_metric.metrics]]
  type = "counter"
  field = "elb_status_code"
  name = "response_code_total"
  namespace = "elb"

    [transforms.elb_to_metric.metrics.tags]
    elb = "{{elb}}"
    user_agent = "{{user_agent}}"

  [[transforms.elb_to_metric.metrics]]
  type = "counter"
  field = "client_host"
  name = "client_host_total"
  namespace = "elb"

    [transforms.elb_to_metric.metrics.tags]
    elb = "{{elb}}"
    user_agent = "{{user_agent}}"

Related issues:

• Use a table field from log events in log_to_metric transform #7565
• enhancement(log_to_metric transform): allow specifying multiple field/name pairs in a given transformation #10934
• logs_to_metric transform should allow for deriving tags field from a field (without specifically listing all the possible keys) #14744

[dogeahill]

This initial comment came from me, and while I do see the value in being able to add tags to each metric individually, the way it currently is written I would've expected those tags to be added to all metrics emitting from this transform.