Skip to content

grokky : ParseInto - #4729

Open
buixor wants to merge 2 commits into
masterfrom
grokky_parseInto
Open

buixor wants to merge 2 commits into
masterfrom
grokky_parseInto

Conversation

@buixor

@buixor buixor commented Oct 2, 2026 •

Copy link
Copy Markdown
Contributor

Implement ParseInto for both RE2 and regexps, and kill Parse.

ParseInto reduces allocations, as we're writing directly into the provided map, avoid an intermediary alloc. Especially effective when it's a miss, but never more expensive.

Allocations

scenario engine B/op allocs/op
stage walk, no match legacy 393 → 0 8 → 0
stage walk, no match re2 384 → 0 8 → 0
stage walk, match on 1st legacy 3,184 → 2,833 4 → 2
stage walk, match on 1st re2 4,816 → 4,480 11 → 9
stage walk, match on 8th legacy 3,410 → 2,706 11 → 2
stage walk, match on 8th re2 5,152 → 4,480 18 → 9
single pattern, no match legacy 48 → 0 1 → 0
single pattern, no match re2 48 → 0 1 → 0
single pattern, match legacy 3,186 → 2,831 4 → 2
single pattern, match re2 4,816 → 4,480 11 → 9
1.2 KB line, no match re2 664 → 0 4 → 0
1.2 KB line, match re2 5,144 → 4,480 13 → 9

CPU

In terms of pure parsing time, performance impact is neglectable when it's a hit.

scenario engine Parse ParseInto Δ
stage walk, no match legacy 1,098 ns 716 ns -34.8%
stage walk, no match re2 6,416 ns 6,019 ns -6.2%
stage walk, match on 1st legacy 6,983 ns 6,672 ns -4.5%
stage walk, match on 1st re2 7,477 ns 7,026 ns -6.0%
stage walk, match on 8th legacy 7,123 ns 6,526 ns -8.4%
stage walk, match on 8th re2 12.6 µs 12.1 µs -4.1%
single pattern, no match legacy 213 ns 153 ns -28.1%
single pattern, no match re2 801 ns 714 ns -10.8%
single pattern, match legacy 6,798 ns 6,544 ns -3.7%
single pattern, match re2 7,176 ns 7,216 ns +0.6% (noise)
1.2 KB line, no match re2 2,948 ns 2,616 ns -11.3%
1.2 KB line, match re2 81.9 µs 81.0 µs -1.0%

Copilot AI balanced review requested due to automatic review settings October 2, 2026 14:46
@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown

@buixor: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

  • /kind feature
  • /kind enhancement
  • /kind refactoring
  • /kind fix
  • /kind chore
  • /kind dependencies
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown

@buixor: There are no area labels on this PR. You can add as many areas as you see fit.

  • /area agent
  • /area local-api
  • /area cscli
  • /area appsec
  • /area security
  • /area configuration
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Tests share mutable destinations across engines, and the PR body lacks the required human review and testing confirmation.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
What changed in this PR

Adds allocation-efficient grok parsing directly into caller-provided maps for both regex engines.

Changes:

  • Introduces ParseInto and uses it in parser nodes.
  • Preserves Parse compatibility.
  • Adds behavioral tests and performance benchmarks.
File Description
pkg/​parser/​node.go Parses captures directly into event data.
pkg/​grok/​pattern.go Extends the pattern interface.
pkg/​grok/​pattern_re2.go Implements RE2 ParseInto.
pkg/​grok/​pattern_legacy.go Implements legacy ParseInto.
pkg/​grok/​compile_test.go Tests both implementations.
pkg/​grok/​bench_test.go Benchmarks allocations and throughput.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread pkg/grok/compile_test.go
Comment on lines +194 to +195
require.Equal(t, tc.want, p.ParseInto(tc.input, tc.dest))
require.Equal(t, tc.after, tc.dest)
@codecov

codecov Bot commented Oct 2, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.05%. Comparing base (e3f795d) to head (8261798).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4729      +/-   ##
==========================================
+ Coverage   71.04%   71.05%   +0.01%     
==========================================
  Files         536      536              
  Lines       36259    36261       +2     
==========================================
+ Hits        25759    25765       +6     
+ Misses      10499    10495       -4     
  Partials        1        1              
Flag Coverage Δ
bats 45.72% <37.50%> (-0.02%) ⬇️
unit-linux 46.64% <100.00%> (-0.05%) ⬇️
unit-windows 34.36% <100.00%> (+0.06%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@buixor

buixor commented Oct 2, 2026

Copy link
Copy Markdown
Contributor Author

/kind enhancement
/area agent

@buixor
buixor added this pull request to stack #4732 October 2, 2026 16:54

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/agent kind/enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants