Entity relationship synthesis with the New Relic eBPF agent

entity-types/ebpf-client/definition.yml

@@ -0,0 +1,16 @@
+domain: EBPF
+type: CLIENT
+synthesis:
+  rules:
+    # Client Entity for Client-Captured Spans (kind == client)
+    - name: local_addr
+      identifier: local_addr
+      encodeIdentifierInGUID: true
+      conditions:
+      - attribute: instrumentation.provider
+        value: nr_ebpf_agent
+      - attribute: kind
+        value: "client"
+      tags:
+        local_addr:
+          entityTagName: "ip"

entity-types/ebpf-client/tests/Span.json

@@ -0,0 +1,11 @@
+[
+  {
+    "redis.req_cmd": "HMGET",
+    "instrumentation.provider": "nr_ebpf_agent",
+    "kind": "client",
+    "local_addr": "192.xxx.x.xx",
+    "local_port": "92" ,
+    "remote_addr": "198.xxx.x.xx",
+    "remote_port": "98"
+  }
+]

entity-types/ebpf-redis_server/definition.yml

@@ -0,0 +1,24 @@
+domain: EBPF
+type: REDIS_SERVER
+synthesis:
+  rules:
+  # Server Entity for Server-Captured Spans (kind == server)
+  - compositeIdentifier:
+        separator: ":"
+        attributes:
+          - local_addr
+          - local_port
+    name: local_addr
+    encodeIdentifierInGUID: true
+    conditions:
+    - attribute: redis.req_cmd
+      present: true
+    - attribute: instrumentation.provider
+      value: "nr_ebpf_agent"
+    - attribute: kind
+      value: "server"
+    tags:
+      local_addr:
+        entityTagName: "ip"
+      local_port:
+        entityTagName: "port"

entity-types/ebpf-redis_server/tests/Span.json

@@ -0,0 +1,11 @@
+[
+  {
+    "redis.req_cmd": "HMGET",
+    "instrumentation.provider": "nr_ebpf_agent",
+    "kind": "server",
+    "local_addr": "198.xxx.x.xx",
+    "local_port": "98",
+    "remote_addr": "192.xxx.x.xx",
+    "remote_port": "92" 
+  }
+]

relationships/candidates/EBPFCLIENT.yml

@@ -0,0 +1,16 @@
+category: EBPFCLIENT
+lookups:
+  - entityTypes:
+    - domain: EBPF
+      type: CLIENT
+    tags:
+      matchingMode: ANY
+      predicates:
+        - tagKeys: ["ip"]
+          field: ip
+    onMatch:
+     onMultipleMatches: RELATE_ALL
+    onMiss:
+      action: CREATE_UNINSTRUMENTED
+      uninstrumented:
+        type: EBPFCLIENT

relationships/candidates/EBPFSERVER.yml

@@ -0,0 +1,18 @@
+category: EBPFSERVER
+lookups:
+  - entityTypes:
+    - domain: EBPF
+      type: REDIS_SERVER
+    tags:
+      matchingMode: ALL
+      predicates:
+        - tagKeys: ["ip"]
+          field: ip
+        - tagKeys: ["port"]
+          field: port
+    onMatch:
+     onMultipleMatches: RELATE_ALL
+    onMiss:
+      action: CREATE_UNINSTRUMENTED
+      uninstrumented:
+        type: EBPFSERVER

relationships/synthesis/EBPF-CLIENT-to-EBPF_REDIS.yml

@@ -0,0 +1,52 @@
+relationships:
+  - name: clientCallsRedisServerFromServerSpan
+    version: "1"
+    origins:
+      - Distributed Tracing
+    conditions:
+      - attribute: eventType
+        anyOf: [ "Span" ]
+      - attribute: entity.type
+        anyOf: [ "REDIS_SERVER" ]
+      - attribute: kind
+        value: "server"
+    relationship:
+      expires: P75M
+      relationshipType: CALLS
+      source:
+        lookupGuid:
+          candidateCategory: EBPFCLIENT
+          fields:
+            - field: ip
+              attribute: remote_addr # clientIP from server's perspective
+      target:
+        extractGuid:
+          attribute: entity.guid
+
+  - name: clientCallsRedisServerFromClientSpan
+    version: "1"
+    origins:
+      - Distributed Tracing
+    conditions:
+      - attribute: eventType
+        anyOf: [ "Span" ]
+      - attribute: entity.type
+        anyOf: [ "EBPF_CLIENT" ]
+      - attribute: kind
+        value: "client"
+      - attribute: redis.req_cmd
+        present: true
+    relationship:
+      expires: P75M
+      relationshipType: CALLS
+      source:
+        extractGuid:
+          attribute: entity.guid
+      target:
+        lookupGuid:
+          candidateCategory: EBPFSERVER
+          fields:
+            - field: ip
+              attribute: remote_addr # serverIP from client's perspective
+            - field: port
+              attribute: remote_port # serverPort from client's perspective