From 00bb6aca22fa65df820b5756378d15fa0229f0a1 Mon Sep 17 00:00:00 2001 From: eric-teambridge Date: Wed, 14 Jan 2026 14:44:43 -0800 Subject: [PATCH 1/3] Patch service tag extraction extract_ddtags_from_message checks for a service tag override using `if "service:" in` which returns true if there's a tag key that ends with `service`, eg `mail_send_service:production`. This causes the lambda to enter the conditional to extract the tag to a first class datadog tag, but the enclosed logic includes a non-defaulted generator which checks for `startswith("service:")`. Since this second check does _not_ match the example, the generator has no elements, and the call to `next` causes the lambda to crash. This change swaps the check to use the same split/startswith functionality that's used inside the conditional. --- aws/logs_monitoring/steps/enrichment.py | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/aws/logs_monitoring/steps/enrichment.py b/aws/logs_monitoring/steps/enrichment.py index f119fd01..ec35f950 100644 --- a/aws/logs_monitoring/steps/enrichment.py +++ b/aws/logs_monitoring/steps/enrichment.py @@ -161,12 +161,9 @@ def extract_ddtags_from_message(event): extracted_ddtags = extracted_ddtags.replace(" ", "") # Extract service tag from message.ddtags if exists - if "service:" in extracted_ddtags: - event[DD_SERVICE] = next( - tag[8:] - for tag in extracted_ddtags.split(",") - if tag.startswith("service:") - ) + service_tags = [tag for tag in extracted_ddtags.split(",") if tag.startswith("service:")] + if service_tags: + event[DD_SERVICE] = service_tags[0][8:] event[DD_CUSTOM_TAGS] = ",".join( [ tag From 97810b87d5d05b5de336e059911f51eacbbd682b Mon Sep 17 00:00:00 2001 From: eric-teambridge Date: Wed, 14 Jan 2026 15:01:20 -0800 Subject: [PATCH 2/3] Include unit test for this edge case --- aws/logs_monitoring/tests/test_enrichment.py | 25 ++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/aws/logs_monitoring/tests/test_enrichment.py b/aws/logs_monitoring/tests/test_enrichment.py index 88b1b3a6..d8b65be5 100644 --- a/aws/logs_monitoring/tests/test_enrichment.py +++ b/aws/logs_monitoring/tests/test_enrichment.py @@ -146,6 +146,31 @@ def test_extract_ddtags_handles_empty_spaces(self): "my_custom_service", ) + def test_extract_ddtags_service_substring_not_prefix(self): + """Test that service tag extraction handles cases where 'service:' appears + as a substring but not as a tag prefix (e.g., in 'myservice:api'). + + Before the fix (old code): + - "service:" in extracted_ddtags would be True + - But next() would raise StopIteration since no tag starts with "service:" + + After the fix (new code): + - List comprehension returns empty list when no tag starts with "service:" + - No exception is raised, service field is not set + """ + loaded_message_tags = {"ddtags": "env:prod,myservice:api,foo:bar"} + event = {"message": loaded_message_tags, "ddtags": "custom_tag:value"} + + extract_ddtags_from_message(event) + + # Service should not be set since no tag actually starts with "service:" + self.assertNotIn("service", event) + # All tags should be preserved in the correct order + self.assertEqual( + event["ddtags"], + "custom_tag:value,env:prod,myservice:api,foo:bar", + ) + class TestExtractHostFromLogEvents(unittest.TestCase): def test_parse_source_cloudtrail(self): From c13914b4cb202241ce9089643321675955ef3024 Mon Sep 17 00:00:00 2001 From: eric-teambridge Date: Thu, 15 Jan 2026 10:59:56 -0800 Subject: [PATCH 3/3] linter yelled --- aws/logs_monitoring/steps/enrichment.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/aws/logs_monitoring/steps/enrichment.py b/aws/logs_monitoring/steps/enrichment.py index ec35f950..b25be32f 100644 --- a/aws/logs_monitoring/steps/enrichment.py +++ b/aws/logs_monitoring/steps/enrichment.py @@ -161,7 +161,9 @@ def extract_ddtags_from_message(event): extracted_ddtags = extracted_ddtags.replace(" ", "") # Extract service tag from message.ddtags if exists - service_tags = [tag for tag in extracted_ddtags.split(",") if tag.startswith("service:")] + service_tags = [ + tag for tag in extracted_ddtags.split(",") if tag.startswith("service:") + ] if service_tags: event[DD_SERVICE] = service_tags[0][8:] event[DD_CUSTOM_TAGS] = ",".join(