[I] [Bug] Endpoints reported through logs are missing from the endpoint list when querying with a time range [skywalking]

["SebastianDT1 (via GitHub)" <gi...@apache.org>]

SebastianDT1 opened a new issue, #14121:
URL: https://github.com/apache/skywalking/issues/14121

   ### Search before asking
   
   - [x] I had searched in the issues and found no similar issues.
   
   ### Apache SkyWalking Component
   
   OAP server (apache/skywalking)
   
   ### What happened
   
   Endpoints that receive logs with an `endpoint` field are not returned by the `findEndpoint` GraphQL query when a `duration` is provided, so they are missing from the Endpoint list of the service in the UI.
   
   Observed with an APISIX gateway using the `skywalking` (traces) and `skywalking-logger` (logs) plugins, both reporting as the same service:
   
   | Scenario | `findEndpoint` with duration (UI Endpoint list) |
   |---|---|
   | Only logs reported | **empty** |
   | Logs + traces, continuous traffic | listed (on 10.4.0, intermittently) |
   | Logs + traces, 30 s to 2 min after traffic stops (UI range: last 30 minutes) | **empty** |
   
   Endpoints of services that only report traces are listed correctly.
   
   Versions: OAP `10.4.0` (BanyanDB `0.10.3`) and OAP `11.0.0` (BanyanDB `0.11.1`).
   
   ### What you expected to happen
   
   An endpoint that received logs and/or traces within the selected time range should be returned by `findEndpoint` with `duration` and shown in the Endpoint list of the service.
   
   ### How to reproduce
   
   Using only the OAP (`apache/skywalking-oap-server:11.0.0` with BanyanDB `0.11.1`; same result on `10.4.0` with BanyanDB `0.10.3`):
   
   1. Send one log with an endpoint:
   
   ```bash
   curl -X POST http://localhost:12800/v3/logs -H 'Content-Type: application/json' \
     -d '[{"service":"repro-svc","serviceInstance":"repro-1","endpoint":"/repro/endpoint","body":{"text":{"text":"hello"}}}]'
   ```
   
   2. Wait about 1 minute and query the endpoints of the service with a time range that includes the moment the log was sent (`serviceId` = base64("repro-svc") + ".1"):
   
   ```bash
   curl -X POST http://localhost:12800/graphql -H 'Content-Type: application/json' \
     -d '{"query":"{ findEndpoint(serviceId: \"cmVwcm8tc3Zj.1\", keyword: \"\", limit: 10, duration: {start: \"<now - 30 min, yyyy-MM-dd HHmm>\", end: \"<now + 1 min, yyyy-MM-dd HHmm>\", step: MINUTE}) { name } }"}'
   ```
   
   Result: `{"data":{"findEndpoint":[]}}`
   
   Expected: `/repro/endpoint` in the list.
   
   ### Anything else
   
   _No response_
   
   ### Are you willing to submit a pull request to fix on your own?
   
   - [ ] Yes I am willing to submit a pull request on my own!
   
   ### Code of Conduct
   
   - [x] I agree to follow this project's Code of Conduct
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Endpoints reported through logs are missing from the endpoint list when querying with a time range [skywalking]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng commented on issue #14121:
URL: https://github.com/apache/skywalking/issues/14121#issuecomment-6028087879

   Thanks for the clear repro. It's a bug since 10.2.0: `findEndpoint` with a `duration` filters on the endpoint's `last_ping`, and endpoints registered from logs never set it. When the same endpoint also receives traces, every log write resets it to 0, which is why it came and went.
   
   Fix: #14122
   
   cc @mrproliu, `last_ping` and the time-range filter came from #12693, which set it only in `EndpointTrafficDispatcher`; `EndpointMetaDispatcher` and `HubbleEndpointDispatcher` were missed.
   
   Until a release includes it, you can generate a metric from the log, because metric-generated endpoints do set `last_ping`. Extract the metric **after** `sink`: the sink writes the endpoint with `last_ping = 0` and the last write wins, so the usual `extractor` → `sink` order doesn't help. Replace `lal/default.yaml` with:
   
   ```yaml
   rules:
     - name: default
       layer: GENERAL
       dsl: |
         filter {
           sink {
           }
           extractor {
             metrics {
               timestamp log.timestamp as Long
               labels service: log.service, endpoint: log.endpoint
               name "log_endpoint_count"
               value 1
             }
           }
         }
   ```
   
   add `log-mal-rules/log-endpoint.yaml`:
   
   ```yaml
   metricPrefix: meter_log
   metricsRules:
     - name: endpoint_count
       exp: log_endpoint_count.sum(['service','endpoint']).downsampling(SUM).endpoint(['service'], ['endpoint'], Layer.GENERAL)
   ```
   
   and set `SW_LOG_MAL_FILES=nginx,miniprogram-wechat,miniprogram-alipay,log-endpoint`. Keep it the only rule in the `GENERAL` layer, and remove it after upgrading.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Endpoints reported through logs are missing from the endpoint list when querying with a time range [skywalking]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng closed issue #14121: [Bug] Endpoints reported through logs are missing from the endpoint list when querying with a time range
URL: https://github.com/apache/skywalking/issues/14121


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org