Merge #64871

64871: sql,log: also include the stmt tag in query logs r=rafiss a=knz

This was requested from a customer through a case handled by @pxlogan 

Release note (sql change): The statement type ("tag") is now also
included alongside the full text of the SQL query in the various
structured log entries produced when query execution is being logged.

Co-authored-by: Raphael 'kena' Poss <[email protected]>

pkg/ccl/logictestccl/testdata/logic_test/multi_region

@@ -1027,7 +1027,7 @@ SELECT "reportingID", info::JSONB - 'Timestamp' - 'DescriptorID'
 FROM system.eventlog
 WHERE "eventType" = 'alter_database_drop_region'
 ----
-1  {"DatabaseName": "drop_region_db", "EventType": "alter_database_drop_region", "RegionName": "\"us-east-1\"", "Statement": "ALTER DATABASE drop_region_db DROP REGION \"us-east-1\"", "User": "root"}
+1  {"DatabaseName": "drop_region_db", "EventType": "alter_database_drop_region", "RegionName": "\"us-east-1\"", "Statement": "ALTER DATABASE drop_region_db DROP REGION \"us-east-1\"", "Tag": "ALTER DATABASE DROP REGION", "User": "root"}
 
 query TTBT colnames
 SHOW REGIONS FROM DATABASE drop_region_db

pkg/sql/admin_audit_log_test.go

@@ -70,7 +70,7 @@ func TestAdminAuditLogBasic(t *testing.T) {
 	db.Exec(t, `SET CLUSTER SETTING sql.log.admin_audit.enabled = true;`)
 	db.Exec(t, `SELECT 1;`)
 
-	var selectAdminRe = regexp.MustCompile(`"EventType":"admin_query","Statement":"‹SELECT 1›","User":"‹root›"`)
+	var selectAdminRe = regexp.MustCompile(`"EventType":"admin_query","Statement":"‹SELECT 1›","Tag":"SELECT","User":"‹root›"`)
 
 	log.Flush()
 

pkg/sql/create_stats.go

@@ -580,6 +580,7 @@ func (r *createStatsResumer) Resume(ctx context.Context, execCtx interface{}) er
 			evalCtx.SessionData.User(),
 			evalCtx.SessionData.ApplicationName,
 			details.Statement,
+			"CREATE STATISTICS",
 			nil,  /* no placeholders known at this point */
 			true, /* writeToEventLog */
 			&eventpb.CreateStatistics{

pkg/sql/event_log.go

@@ -65,9 +65,10 @@ func (p *planner) logEventsWithSystemEventLogOption(
 ) error {
 	user := p.User()
 	stmt := tree.AsStringWithFQNames(p.stmt.AST, p.extendedEvalCtx.EvalContext.Annotations)
+	stmtTag := p.stmt.AST.StatementTag()
 	pl := p.extendedEvalCtx.EvalContext.Placeholders.Values
 	appName := p.SessionData().ApplicationName
-	return logEventInternalForSQLStatements(ctx, p.extendedEvalCtx.ExecCfg, p.txn, descIDs, user, appName, stmt, pl, writeToEventLog, events...)
+	return logEventInternalForSQLStatements(ctx, p.extendedEvalCtx.ExecCfg, p.txn, descIDs, user, appName, stmt, stmtTag, pl, writeToEventLog, events...)
 }
 
 // logEventInternalForSchemaChange emits a cluster event in the
@@ -119,14 +120,15 @@ func logEventInternalForSQLStatements(
 	user security.SQLUsername,
 	appName string,
 	stmt string,
+	stmtTag string,
 	placeholders tree.QueryArguments,
 	writeToEventLog bool,
 	events ...eventpb.EventPayload,
 ) error {
 	// Inject the common fields into the payload provided by the caller.
 	for i := range events {
 		if err := injectCommonFields(
-			txn, descIDs[i], user, appName, stmt, placeholders, events[i],
+			txn, descIDs[i], user, appName, stmt, stmtTag, placeholders, events[i],
 		); err != nil {
 			return err
 		}
@@ -152,6 +154,7 @@ func injectCommonFields(
 	user security.SQLUsername,
 	appName string,
 	stmt string,
+	stmtTag string,
 	placeholders tree.QueryArguments,
 	event eventpb.EventPayload,
 ) error {
@@ -162,6 +165,7 @@ func injectCommonFields(
 	}
 	m := sqlCommon.CommonSQLDetails()
 	m.Statement = stmt
+	m.Tag = stmtTag
 	m.ApplicationName = appName
 	m.User = user.Normalized()
 	m.DescriptorID = uint32(descID)

pkg/sql/logictest/testdata/logic_test/distsql_event_log

@@ -26,8 +26,8 @@ FROM system.eventlog
 WHERE "eventType" = 'create_statistics'
 ORDER BY "timestamp", info
 ----
-53  1  {"EventType": "create_statistics", "Statement": "CREATE STATISTICS s1 ON id FROM test.public.a", "TableName": "test.public.a", "User": "root"}
-53  1  {"EventType": "create_statistics", "Statement": "CREATE STATISTICS __auto__ FROM test.public.a", "TableName": "test.public.a", "User": "root"}
+53  1  {"EventType": "create_statistics", "Statement": "CREATE STATISTICS s1 ON id FROM test.public.a", "TableName": "test.public.a", "Tag": "CREATE STATISTICS", "User": "root"}
+53  1  {"EventType": "create_statistics", "Statement": "CREATE STATISTICS __auto__ FROM test.public.a", "TableName": "test.public.a", "Tag": "CREATE STATISTICS", "User": "root"}
 
 statement ok
 DROP TABLE a

pkg/util/log/eventpb/events.proto

@@ -37,6 +37,11 @@ message CommonSQLEventDetails {
   // A normalized copy of the SQL statement that triggered the event.
   string statement = 1 [(gogoproto.jsontag) = ",omitempty"];
 
+  // The statement tag. This is separate from the statement string,
+  // since the statement string can contain sensitive information. The
+  // tag is guaranteed not to.
+  string tag = 6 [(gogoproto.jsontag) = ",omitempty", (gogoproto.moretags) = "redact:\"nonsensitive\""];
+
   // The user account that triggered the event.
   string user = 2 [(gogoproto.jsontag) = ",omitempty"];
 
@@ -59,7 +64,7 @@ message CommonJobEventDetails {
   int64 job_id = 1 [(gogoproto.customname) = "JobID", (gogoproto.jsontag) = ",omitempty"];
 
   // The type of the job that triggered the event.
-  string job_type = 2 [(gogoproto.customname) = "JobType", (gogoproto.jsontag) = ",omitempty", (gogoproto.moretags) = "redact:\"nonsensitive\""];
+  string job_type = 2 [(gogoproto.jsontag) = ",omitempty", (gogoproto.moretags) = "redact:\"nonsensitive\""];
 
   // A description of the job that triggered the event. Some jobs populate the
   // description with an approximate representation of the SQL statement run to