processor_sql: preserve resource and scope groups when filtering logs

[edsiper]

A SQL WHERE predicate applied to grouped OTLP logs also evaluates the resource/scope group markers. When those markers do not contain the queried field, SQL deletes them, and surviving logs lose their resource/scope metadata. Skip transport group markers and apply SQL predicates only to normal log records. Existing group normalization removes envelopes whose logs were all dropped.

For two resource groups containing ids 1–4, SELECT * FROM STREAM WHERE id = 1; now retains id 1 with its original resource and scope, removes the empty second group, and reports one logical output record. This reproduces on unchanged master in both input and output processor contexts. No configuration or bundled-library changes; the performance optimization is a separate PR.

Local validation

• Independent Release build from master, runtime/internal tests enabled.
• Six integration cases pass normally and under strict Valgrind: keep all groups, partial/whole-group drops, and empty batch; input and output contexts, filesystem storage and two-route fan-out.
• Compare complete surviving resources/scopes, schema URLs, body, timestamps, severity, trace/span IDs, flags and log attributes. Verify empty envelopes disappear and group markers do not inflate counters.
• All six Valgrind runs report zero errors and zero definite/indirect/possible leaks.
• Three CTest targets pass: processor, processor_conditional and mp_chunk_cobj.
• Full two-commit PR range passes commit-prefix lint against fetched master; both commits are DCO signed.

Focused commands from tests/integration, with FLUENT_BIT_BINARY pointing at this branch's binary:

python -m pytest scenarios/processor_sql -q
VALGRIND=1 VALGRIND_STRICT=1 python -m pytest scenarios/processor_sql -q

ctest --test-dir build -R '^flb-it-(processor|processor_conditional|mp_chunk_cobj)$' --output-on-failure

Example SQL processor:

processors:
  logs:
    - name: sql
      query: SELECT * FROM STREAM WHERE id = 1;

ERROR SUMMARY: 0 errors
Definite / indirect / possible leaked bytes: 0 / 0 / 0

Packaging/documentation: N/A. Target: master; no backport included.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}