Keda integration Logs

[steveny91]

What does this PR do?

Logs pipeline for Keda

https://datadoghq.atlassian.net/browse/LOI-379

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.11%. Comparing base (b3da55a) to head (d613b74).
Report is 3 commits behind head on master.

Additional details and impacted files

Flag	Coverage Δ
activemq	?
cassandra	?
hive	?
hivemq	?
hudi	?
ignite	?
jboss_wildfly	?
kafka	?
keda	88.05% <ø> (ø)
presto	?
solr	?

Flags with carried forward coverage won't be shown. Click here to find out more.

[brunorenier]

There are quite a few places where we can refactor the grok expression to rely less on data. This is highly recommended as expressions with many data or expensive regexes might lead to the parsing being aborted if too inefficient.

[steveny91]

@brunorenier Thanks for all the help so far! I really appreciate your input. I incorporated almost all of your suggestions, the only one I didn't I ended up dropping that rule and replacing it with something else. I think the only data matchers left are the ones for the keyvalues. Not sure if you have any ideas on how to address those. Thanks in advance and I do apologize for my shallow knowledge on the matter.

[brunorenier]

@brunorenier Thanks for all the help so far! I really appreciate your input. I incorporated almost all of your suggestions, the only one I didn't I ended up dropping that rule and replacing it with something else. I think the only data matchers left are the ones for the keyvalues. Not sure if you have any ideas on how to address those. Thanks in advance and I do apologize for my shallow knowledge on the matter.

Thanks for your patience and making all those changes! Those grok parser rules are really tricky and it's not obvious that using data to much can have some bad side effects. Keeping the data matchers for the json/kv matching at the end of the rules is fine. What we really try to avoid is having multiple data matchers (or .*) in a single rule.

I'll deploy this integration to our staging env for a final check then approve.