Decrease Clones

CHANGELOG.next.asciidoc

@@ -73,6 +73,7 @@ https:/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Do not print context cancelled error message when running under agent {pull}36006[36006]
 - Fix recovering from invalid output configuration when running under Elastic-Agent {pull}36016[36016]
 - Improve StreamBuf append to improve performance when reading long lines from files. {pull}35928[35928]
+- Eliminate cloning of event in deepUpdate {pull}35945[35945]
 
 *Auditbeat*
 

libbeat/beat/event.go

@@ -110,45 +110,62 @@ func (e *Event) deepUpdate(d mapstr.M, overwrite bool) {
  if len(d) == 0 {
  return
  }
- fieldsUpdate := d.Clone() // so we can delete redundant keys
 
- var metaUpdate mapstr.M
+ // It's supported to update the timestamp using this function.
+ // However, we must handle it separately since it's a separate field of the event.
+ timestampValue, timestampExists := d[timestampFieldKey]
+ if timestampExists {
+ if overwrite {
+ _ = e.setTimestamp(timestampValue)
+ }
 
- for fieldKey, value := range d {
- switch fieldKey {
+ // Temporary delete it from the update map,
+ // so we can do `e.Fields.DeepUpdate(d)` or
+ // `e.Fields.DeepUpdateNoOverwrite(d)` later
+ delete(d, timestampFieldKey)
+ }
 
- // one of the updates is the timestamp which is not a part of the event fields
- case timestampFieldKey:
- if overwrite {
- _ = e.setTimestamp(value)
- }
- delete(fieldsUpdate, fieldKey)
+ // It's supported to update the metadata using this function.
+ // However, we must handle it separately since it's a separate field of the event.
+ metaValue, metaExists := d[metadataFieldKey]
+ if metaExists {
+ var metaUpdate mapstr.M
 
- // some updates are addressed for the metadata not the fields
- case metadataFieldKey:
- switch meta := value.(type) {
- case mapstr.M:
- metaUpdate = meta
- case map[string]interface{}:
- metaUpdate = mapstr.M(meta)
- }
+ switch meta := metaValue.(type) {
+ case mapstr.M:
+ metaUpdate = meta
+ case map[string]interface{}:
+ metaUpdate = mapstr.M(meta)
+ }
 
- delete(fieldsUpdate, fieldKey)
+ if metaUpdate != nil {
+ if e.Meta == nil {
+ e.Meta = mapstr.M{}
+ }
+ if overwrite {
+ e.Meta.DeepUpdate(metaUpdate)
+ } else {
+ e.Meta.DeepUpdateNoOverwrite(metaUpdate)
+ }
  }
+
+ // Temporary delete it from the update map,
+ // so we can do `e.Fields.DeepUpdate(d)` or
+ // `e.Fields.DeepUpdateNoOverwrite(d)` later
+ delete(d, metadataFieldKey)
  }
 
- if metaUpdate != nil {
- if e.Meta == nil {
- e.Meta = mapstr.M{}
+ // At the end we revert all changes we made to the update map
+ defer func() {
+ if timestampExists {
+ d[timestampFieldKey] = timestampValue
  }
- if overwrite {
- e.Meta.DeepUpdate(metaUpdate)
- } else {
- e.Meta.DeepUpdateNoOverwrite(metaUpdate)
+ if metaExists {
+ d[metadataFieldKey] = metaValue
  }
- }
+ }()
 
- if len(fieldsUpdate) == 0 {
+ if len(d) == 0 {
  return
  }
 
@@ -157,9 +174,9 @@ func (e *Event) deepUpdate(d mapstr.M, overwrite bool) {
  }
 
  if overwrite {
- e.Fields.DeepUpdate(fieldsUpdate)
+ e.Fields.DeepUpdate(d)
  } else {
- e.Fields.DeepUpdateNoOverwrite(fieldsUpdate)
+ e.Fields.DeepUpdateNoOverwrite(d)
  }
 }