Support LAL json{} parsing JSON delivered in text log bodies; fix abortOnFailure wiring and leak-probe timing

[wu-sheng]

Support LAL json {} parsing JSON content delivered in a plain-text log body

• If this is non-trivial feature, paste the links/URLs to the design doc.
• Update the documentation to include this new feature.
• Tests(including UT, IT, E2E) are added to verify the new feature.

The OTLP log receiver delivers every string body as a text body, even JSON-shaped ones, while json {} read only the JSON body case — so json {} rules on OTLP-fed layers silently aborted. json {} now reads the JSON body first and, when it is empty, tries the text body as JSON. On a successful text-fallback parse the matching rule's context input is swapped to a copy with a JSON body, so that rule persists the log with content type JSON; the shared input is never mutated, and other rules analyzing the same log still see the original text body. Design discussion is summarized in the updated lal.md json section and log-otlp.md.

Fix the LAL abortOnFailure option being silently ignored in the v2 compiler

• Add a unit test to verify that the fix works.
• Explain briefly why the bug exists and how to fix it.

The DSL flag was parsed into the rule model but never emitted into the generated code, so json {} / yaml {} / text { regexp } always used the built-in default and abortOnFailure false had no effect (for all three parsers, including the regexp case). The compiler now bakes each rule's flag into the generated parser call (default true, as documented, fixed from a latent false model default). A parse failure or regexp non-match that aborts the log is reported at WARN, rate-limited to one report per minute per parser with the suppressed count included in the next report; with abortOnFailure false the failure is DEBUG-only, the log continues, and parsed.* reads fall back to metadata fields instead of NPE-dropping the log. Typed-proto inputs (e.g. Envoy ALS entries hitting the MESH json {} routing guard) stay quiet as before.

Fix delayed DSL classloader leak detection (follow-up to #13935)

• Add a unit test to verify that the fix works.
• Explain briefly why the bug exists and how to fix it.

The unload probe was minted at loader-retire time and recorded its mint time as evidence, so evidenceUpToMs >= retiredAt + settleMs could never hold on the first collected probe — a real leak needed two class-unloading GC cycles (potentially hours apart on a quiet heap) before the WARN fired. Probes are now armed on demand once a pending entry's settle window has elapsed, and the collected probe's mint time is recorded: sound evidence (no drain-time overshoot from sweeper stalls), single-GC detection, and zero probe cost for loaders that collect normally.

• If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #.
• Update the CHANGES log.

The CHANGES entry covers the json {} feature only; the abortOnFailure wiring and the leak-probe timing fix are refinements of unreleased behavior.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR enhances LAL parsing and runtime behavior for OTLP-delivered logs by enabling json {} to parse JSON-shaped text bodies, correctly wiring abortOnFailure into v2-generated code, and improving DSL classloader leak detection timing.

Changes:

• Extend json {} to fall back to parsing the text body as JSON and normalize the persisted body to JSON for the matching rule.
• Fix v2 compiler/codegen to pass each rule’s abortOnFailure flag into json/yaml/text-regexp parser calls, and make failures rate-limited at WARN when aborting.
• Adjust DSL classloader GC/leak-probe arming to avoid delayed leak detection; update docs and extend execution tests/data.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/classloader/DSLClassLoaderManager.java	Pass settle window to graveyard sweep to support on-demand probe arming.
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/classloader/ClassLoaderGc.java	Rework probe arming/draining to provide timely leak evidence after settle window.
oap-server/analyzer/log-analyzer/src/test/resources/scripts/lal/test-lal/feature-cases/execution-basic.yaml	Add feature-case rules for json-text fallback and abortOnFailure=false paths.
oap-server/analyzer/log-analyzer/src/test/resources/scripts/lal/test-lal/feature-cases/execution-basic.data.yaml	Add test inputs/expectations for JSON normalization + abortOnFailure behavior.
oap-server/analyzer/log-analyzer/src/test/java/org/apache/skywalking/oap/log/analyzer/v2/compiler/LALScriptExecutionTest.java	Assert persisted body “content type” based on rewritten input body oneof.
oap-server/analyzer/log-analyzer/src/test/java/org/apache/skywalking/oap/log/analyzer/v2/compiler/LALClassGeneratorBasicTest.java	Update assertions to reflect abortOnFailure being baked into generated calls.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/dsl/spec/parser/TextParserSpec.java	Thread-safe WARN rate limiting + abortOnFailure parameterization for regexp parser.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/dsl/spec/parser/ParseFailureWarnLimiter.java	New limiter utility to prevent WARN flooding while tracking suppressed counts.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/dsl/spec/parser/AbstractParserSpec.java	Remove shared abortOnFailure state; document compile-time flag propagation instead.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/dsl/spec/filter/FilterSpec.java	Implement json text-body fallback + input normalization; wire abortOnFailure + logging.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/dsl/ExecutionContext.java	Add input(Object) setter so parsers can swap in rule-local normalized input copies.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/compiler/rt/LalRuntimeHelper.java	Make regexp group reads null-safe when abortOnFailure=false allows continuation.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/compiler/LALScriptParser.java	Fix abortOnFailure default to true (documented) during script parsing.
oap-server/analyzer/log-analyzer/src/main/java/org/apache/skywalking/oap/log/analyzer/v2/compiler/LALClassGenerator.java	Emit parser invocations with per-rule abortOnFailure argument.
oap-server/analyzer/log-analyzer/CLAUDE.md	Update internal docs to reflect new generated call signatures.
docs/en/setup/backend/log-otlp.md	Document OTLP text-body JSON behavior and json {} fallback/normalization.
docs/en/concepts-and-designs/lal.md	Document json {} fallback semantics, normalization scope, and failure logging.
docs/en/changes/changes.md	Add CHANGES entry describing the json {} text-body JSON support.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.