Route LAL rules within a layer by input type; add envoy-als-tcp rule

[wankai123]

Route LAL rules within a layer by input type; add envoy-als-tcp

LAL rules keyed to the same telemetry layer are all evaluated against every log of
that layer. When a layer carries more than one proto input shape this breaks: the
generated parsed.* code casts the input unconditionally, so a rule compiled for one
proto throws ClassCastException on another. On Layer.MESH both HTTP and TCP Envoy
access logs (and network-profiling LogData) share the bucket, so the HTTP envoy-als
rule already throws — caught in LogFilterListener.build() and logged per log — whenever
a TCP entry or a network-profiling log arrives.

This PR makes rule dispatch input-type aware:

• Each compiled rule now carries its effective input type — the proto class its
  parsed.* getters cast to, or null for parser-based (json/yaml/text) and
  untyped rules, which continue to run against any input. Derived once at compile time
  in LALClassGenerator and threaded onto the DSL.
• LogFilterListener.parse() skips any rule whose declared input type does not match the
  incoming object (inputType.isInstance(input)), so each entry only reaches the rules
  meant for it. This removes the latent ClassCastException and the per-log WARN spam.
• Routing keys off the effective type, not the resolved one, so a parser-based rule
  such as network-profiling-slow-trace (whose SPI-resolved type is HTTPAccessLogEntry
  but which reads a parsed map) is never wrongly filtered.

Adds an envoy-als-tcp rule (inputType: io.envoyproxy.envoy.data.accesslog.v3.TCPAccessLogEntry)
alongside the existing HTTP envoy-als; both share Layer.MESH and each now only sees
its own entry type. TCP entries have no HTTP status code, so the rule filters on
commonProperties.responseFlags and samples by service:responseFlags.

New feature / behavior

• This builds on the existing LAL per-rule inputType + LALSourceTypeProvider SPI
  mechanism (documented in oap-server/analyzer/log-analyzer/CLAUDE.md); no separate design doc.
• Update the documentation to include this new feature. (CHANGES log)
• Tests (UT) are added to verify the new feature.
• Not UI related.

Also fixes a latent bug

• Added unit tests reproducing the mixed-input-type dispatch (LogFilterListenerRoutingTest):
  an HTTP entry reaches only the HTTP + parser rules, a TCP entry only the TCP + parser rules,
  no cross-type ClassCastException.
• Root cause: parsed.* codegen emits an unguarded proto cast, and every rule in a layer
  runs against every input; fix routes by the rule's effective input type before evaluation.

Tests added

• LogFilterListenerRoutingTest — routing selection (3 cases).

• LALClassGeneratorExtractorTest — effectiveInputType derivation (parser ⇒ null) and a
  compile guard for the shipped envoy-als-tcp rule against TCPAccessLogEntry.

• envoy-als-tcp data-driven execution cases in LALScriptExecutionTest (abnormal ⇒ tag +
  save; normal ⇒ abort).

• If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #.

• Update the CHANGES log.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This pull request updates the Log Analyzer (LAL) runtime to route rules within the same telemetry layer by each rule’s effective input type, preventing cross-proto evaluation that can trigger ClassCastException when multiple input shapes share a layer (notably Layer.MESH). It also adds a TCP Envoy ALS rule to complement the existing HTTP rule.

Changes:

• Add input-type-aware rule dispatch in LogFilterListener by skipping rules whose effective input type doesn’t match the incoming log object.
• Thread “effective input type” from compile-time (LALClassGenerator) into runtime rule metadata (DSL) for routing.
• Add envoy-als-tcp LAL rule plus unit/data-driven tests, and document the behavior change in docs/en/changes/changes.md.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
oap-server/server-starter/src/main/resources/lal/envoy-als.yaml	Adds the new envoy-als-tcp rule (typed to TCPAccessLogEntry) alongside existing MESH rules.
oap-server/analyzer/log-analyzer/src/test/resources/scripts/lal/test-lal/oap-cases/envoy-als.yaml	Mirrors the shipped rules for script-based test execution cases, including envoy-als-tcp.
oap-server/analyzer/log-analyzer/src/test/resources/scripts/lal/test-lal/oap-cases/envoy-als.data.yaml	Adds data-driven execution cases for envoy-als-tcp.
oap-server/analyzer/log-analyzer/src/test/java/org/apache/skywalking/oap/log/analyzer/v2/provider/log/listener/LogFilterListenerRoutingTest.java	Adds unit tests asserting typed rules only run for matching proto inputs, while untyped/parser rules still run.
oap-server/analyzer/log-analyzer/src/test/java/org/apache/skywalking/oap/log/analyzer/v2/compiler/LALClassGeneratorExtractorTest.java	Adds tests for effective input type derivation and a compile guard for the new TCP rule’s parsed.* chains.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/provider/log/listener/LogFilterListener.java	Implements per-log active rule selection based on dsl.getInputType().isInstance(input).
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/dsl/DSL.java	Stores the compile-derived effective input type on each compiled rule for runtime routing.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/compiler/LALClassGenerator.java	Derives and exposes effectiveInputType (null when a parser is present) during compilation.
docs/en/changes/changes.md	Documents the new routing behavior and the addition of envoy-als-tcp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.