Unique name for TopN metrics

src/Metrics.h

@@ -234,11 +234,13 @@ class TopN final : public Metric
 private:
     datasketches::frequent_items_sketch<T> _fi;
     size_t _top_count = 10;
+    std::string _item_key;
 
 public:
-    TopN(std::string schema_key, std::initializer_list<std::string> names, std::string desc)
+    TopN(std::string schema_key, std::string item_key, std::initializer_list<std::string> names, std::string desc)
         : Metric(schema_key, names, std::move(desc))
         , _fi(MAX_FI_MAP_SIZE, START_FI_MAP_SIZE)
+        , _item_key(item_key)
     {
     }
 
@@ -280,7 +282,7 @@ class TopN final : public Metric
         out << "# HELP " << base_name_snake() << ' ' << _desc << std::endl;
         out << "# TYPE " << base_name_snake() << " gauge" << std::endl;
         for (uint64_t i = 0; i < std::min(_top_count, items.size()); i++) {
-            l["name"] = formatter(items[i].get_item());
+            l[_item_key] = formatter(items[i].get_item());
             out << name_snake({}, l) << ' ' << items[i].get_estimate() << std::endl;
         }
     }
@@ -306,7 +308,7 @@ class TopN final : public Metric
         for (uint64_t i = 0; i < std::min(_top_count, items.size()); i++) {
             std::stringstream name_text;
             name_text << items[i].get_item();
-            l["name"] = name_text.str();
+            l[_item_key] = name_text.str();
             out << name_snake({}, l) << ' ' << items[i].get_estimate() << std::endl;
         }
     }

src/handlers/dns/DnsStreamHandler.cpp

@@ -560,6 +560,8 @@ void DnsMetricsBucket::process_dns_layer(bool deep, DnsLayer &payload, bool dnst
     if (query) {
 
         auto name = query->getName();
+        std::transform(name.begin(), name.end(), name.begin(),
+            [](unsigned char c) { return std::tolower(c); });
 
         _dns_qnameCard.update(name);
         _dns_topQType.update(query->getDnsType());

src/handlers/dns/DnsStreamHandler.h

@@ -9,8 +9,8 @@
 #include "PcapInputStream.h"
 #include "StreamHandler.h"
 #include "dns.h"
-#include "querypairmgr.h"
 #include "dnstap.pb.h"
+#include "querypairmgr.h"
 #include <Corrade/Utility/Debug.h>
 #include <bitset>
 #include <limits>
@@ -93,16 +93,16 @@ class DnsMetricsBucket final : public visor::AbstractMetricsBucket
         : _dnsXactFromTimeUs("dns", {"xact", "out", "quantiles_us"}, "Quantiles of transaction timing (query/reply pairs) when host is client, in microseconds")
         , _dnsXactToTimeUs("dns", {"xact", "in", "quantiles_us"}, "Quantiles of transaction timing (query/reply pairs) when host is server, in microseconds")
         , _dns_qnameCard("dns", {"cardinality", "qname"}, "Cardinality of unique QNAMES, both ingress and egress")
-        , _dns_topQname2("dns", {"top_qname2"}, "Top QNAMES, aggregated at a depth of two labels")
-        , _dns_topQname3("dns", {"top_qname3"}, "Top QNAMES, aggregated at a depth of three labels")
-        , _dns_topNX("dns", {"top_nxdomain"}, "Top QNAMES with result code NXDOMAIN")
-        , _dns_topREFUSED("dns", {"top_refused"}, "Top QNAMES with result code REFUSED")
-        , _dns_topSRVFAIL("dns", {"top_srvfail"}, "Top QNAMES with result code SRVFAIL")
-        , _dns_topUDPPort("dns", {"top_udp_ports"}, "Top UDP source port on the query side of a transaction")
-        , _dns_topQType("dns", {"top_qtype"}, "Top query types")
-        , _dns_topRCode("dns", {"top_rcode"}, "Top result codes")
-        , _dns_slowXactIn("dns", {"xact", "in", "top_slow"}, "Top QNAMES in transactions where host is the server and transaction speed is slower than p90")
-        , _dns_slowXactOut("dns", {"xact", "out", "top_slow"}, "Top QNAMES in transactions where host is the client and transaction speed is slower than p90")
+        , _dns_topQname2("dns", "qname", {"top_qname2"}, "Top QNAMES, aggregated at a depth of two labels")
+        , _dns_topQname3("dns", "qname", {"top_qname3"}, "Top QNAMES, aggregated at a depth of three labels")
+        , _dns_topNX("dns", "qname", {"top_nxdomain"}, "Top QNAMES with result code NXDOMAIN")
+        , _dns_topREFUSED("dns", "qname", {"top_refused"}, "Top QNAMES with result code REFUSED")
+        , _dns_topSRVFAIL("dns", "qname", {"top_srvfail"}, "Top QNAMES with result code SRVFAIL")
+        , _dns_topUDPPort("dns", "port", {"top_udp_ports"}, "Top UDP source port on the query side of a transaction")
+        , _dns_topQType("dns", "qtype", {"top_qtype"}, "Top query types")
+        , _dns_topRCode("dns", "rcode", {"top_rcode"}, "Top result codes")
+        , _dns_slowXactIn("dns", "qname", {"xact", "in", "top_slow"}, "Top QNAMES in transactions where host is the server and transaction speed is slower than p90")
+        , _dns_slowXactOut("dns", "qname", {"xact", "out", "top_slow"}, "Top QNAMES in transactions where host is the client and transaction speed is slower than p90")
     {
         set_event_rate_info("dns", {"rates", "total"}, "Rate of all DNS wire packets (combined ingress and egress) per second");
         set_num_events_info("dns", {"wire_packets", "total"}, "Total DNS wire packets");

src/handlers/dns/tests/test_dns_layer.cpp

@@ -226,7 +226,7 @@ TEST_CASE("Parse DNS random UDP/TCP tests", "[pcap][dns]")
     nlohmann::json j;
     dns_handler.metrics()->bucket(0)->to_json(j);
 
-    CHECK(j["cardinality"]["qname"] == 2055); // flame was run with 1000 randoms x2 (udp+tcp)
+    CHECK(j["cardinality"]["qname"] == 2036); // flame was run with 1000 randoms x2 (udp+tcp)
 
     CHECK(j["top_qname2"][0]["name"] == ".test.com");
     CHECK(j["top_qname2"][0]["estimate"] == event_data.num_events->value());

src/handlers/net/NetStreamHandler.h

@@ -63,10 +63,10 @@ class NetworkMetricsBucket final : public visor::AbstractMetricsBucket
     NetworkMetricsBucket()
         : _srcIPCard("packets", {"cardinality", "src_ips_in"}, "Source IP cardinality")
         , _dstIPCard("packets", {"cardinality", "dst_ips_out"}, "Destination IP cardinality")
-        , _topGeoLoc("packets", {"top_geoLoc"}, "Top GeoIP locations")
-        , _topASN("packets", {"top_ASN"}, "Top ASNs by IP")
-        , _topIPv4("packets", {"top_ipv4"}, "Top IPv4 IP addresses")
-        , _topIPv6("packets", {"top_ipv6"}, "Top IPv6 IP addresses")
+        , _topGeoLoc("packets", "geo_loc", {"top_geoLoc"}, "Top GeoIP locations")
+        , _topASN("packets", "asn", {"top_ASN"}, "Top ASNs by IP")
+        , _topIPv4("packets", "ipv4", {"top_ipv4"}, "Top IPv4 IP addresses")
+        , _topIPv6("packets", "ipv6", {"top_ipv6"}, "Top IPv6 IP addresses")
         , _rate_in("packets", {"rates", "pps_in"}, "Rate of ingress in packets per second")
         , _rate_out("packets", {"rates", "pps_out"}, "Rate of egress in packets per second")
     {

src/tests/test_metrics.cpp

@@ -179,8 +179,8 @@ TEST_CASE("TopN metrics", "[metrics][topn]")
     json j;
     std::stringstream output;
     std::string line;
-    TopN<std::string> top_sting("root", {"test", "metric"}, "A topn test metric");
-    TopN<uint16_t> top_int("root", {"test", "metric"}, "A topn test metric");
+    TopN<std::string> top_sting("root", "string", {"test", "metric"}, "A topn test metric");
+    TopN<uint16_t> top_int("root", "integer", {"test", "metric"}, "A topn test metric");
 
     SECTION("TopN to json")
     {
@@ -213,9 +213,9 @@ TEST_CASE("TopN metrics", "[metrics][topn]")
         std::getline(output, line);
         CHECK(line == "# TYPE root_test_metric gauge");
         std::getline(output, line);
-        CHECK(line == R"(root_test_metric{instance="test instance",name="top1",policy="default"} 2)");
+        CHECK(line == R"(root_test_metric{instance="test instance",policy="default",string="top1"} 2)");
         std::getline(output, line);
-        CHECK(line == R"(root_test_metric{instance="test instance",name="top2",policy="default"} 1)");
+        CHECK(line == R"(root_test_metric{instance="test instance",policy="default",string="top2"} 1)");
     }
 
     SECTION("TopN prometheus formatter")
@@ -230,9 +230,9 @@ TEST_CASE("TopN metrics", "[metrics][topn]")
         std::getline(output, line);
         CHECK(line == "# TYPE root_test_metric gauge");
         std::getline(output, line);
-        CHECK(line == R"(root_test_metric{instance="test instance",name="123",policy="default"} 2)");
+        CHECK(line == R"(root_test_metric{instance="test instance",integer="123",policy="default"} 2)");
         std::getline(output, line);
-        CHECK(line == R"(root_test_metric{instance="test instance",name="10",policy="default"} 1)");
+        CHECK(line == R"(root_test_metric{instance="test instance",integer="10",policy="default"} 1)");
     }
 }