[pkg/ottl] The replace_pattern function with a Function arg replaces text outside the matched position

[Nagato-Yuzuru]

Component(s)

pkg/ottl

What happened?

Description

When replace_pattern is given an optional Function argument (e.g. SHA256), each match's text is replaced everywhere it appears in the input, not just at the match position. Inputs where no match's text appears inside another's happen to work.

e.g. on "user_id=42 parent_user_id=423" with pattern \d+ and function SHA256, both IDs end up replaced by SHA256("42"). The hash of 423 never appears in the output, and a stray 3 is left behind.

Steps to Reproduce

use v0.151.0 (likely exists in all less current versions)

Reproducible on https://ottl.run/ with the config and payload below.

Expected Result

Reference SHA-256 values for the two IDs in the input:
SHA256("42") = 73475cb40a568e8da8a045ced110137e159f890ac4da883b6b17dc651b3a8049
SHA256("423") = 814bb6b8dc12188a44b71e378dc20a4292e01979aa9ab95b09b8a681391dfc9d

{
  "resourceLogs": [
    {
      "resource": {},
      "scopeLogs": [
        {
          "scope": {},
          "logRecords": [
            {
              "timeUnixNano": "1700000000000000000",
              "body": {
                "stringValue": "test"
              },
              "attributes": [
                {
                  "key": "msg",
                  "value": {
                    "stringValue": "action=update user_id=73475cb40a568e8da8a045ced110137e159f890ac4da883b6b17dc651b3a8049 parent_user_id=814bb6b8dc12188a44b71e378dc20a4292e01979aa9ab95b09b8a681391dfc9d"
                  }
                }
              ]
            }
          ]
        }
      ]
    }
  ]
}

Actual Result

{
  "resourceLogs": [
    {
      "resource": {},
      "scopeLogs": [
        {
          "scope": {},
          "logRecords": [
            {
              "timeUnixNano": "1700000000000000000",
              "body": {
                "stringValue": "test"
              },
              "attributes": [
                {
                  "key": "msg",
                  "value": {
                    "stringValue": "action=update user_id=73475cb40a568e8da8a045ced110137e159f890ac4da883b6b17dc651b3a8049 parent_user_id=73475cb40a568e8da8a045ced110137e159f890ac4da883b6b17dc651b3a80493"
                  }
                }
              ]
            }
          ]
        }
      ]
    }
  ]
}

Collector version

v0.151.0

Environment information

OS: alpine:3.22.4

OpenTelemetry Collector configuration

transform:
  log_statements:
    - context: log
      statements:
        - replace_pattern(attributes["msg"], "(?P<id>\\d+)", "$1", SHA256)

Log output

{
  "resourceLogs": [{
    "resource": {},
    "scopeLogs": [{
      "scope": {},
      "logRecords": [{
        "timeUnixNano": "1700000000000000000",
        "body": {"stringValue": "test"},
        "attributes": [
          {"key": "msg", "value": {"stringValue": "action=update user_id=42 parent_user_id=423"}}
        ]
      }]
    }]
  }]
}

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[github-actions]

Pinging code owners:

• pkg/ottl: @TylerHelmuth @evan-bradley @edmocosta @bogdandrutu

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[Nagato-Yuzuru]

Looks like the offending line is pkg/ottl/ottlfuncs/func_replace_pattern.go:96. strings.ReplaceAll is the wrong primitive here. Happy to send a PR switching to position-based splicing.