[extension/awslogsencoding] Improve performance on text VPC flow logs

[constanca-m]

Component(s)

extension/encoding/awslogsencoding

Is your feature request related to a problem? Please describe.

Improve performance on how we are handling VPC flow logs.

Describe the solution you'd like

Improve performance by:

• [extension/awslogs_encoding] Add support for VPC flow logs in plain text file format #38897 (comment):

For a followup:

Unless there's a bug in the parser, the number of fields should always match, so let's optimise for that. I suggest we remove this check here and count the fields as we're parsing to reduce overhead. Then at the very end we can return an error if the number of fields parsed does not match expectations.

Originally posted by @axw in #38897 (comment)

• [extension/awslogs_encoding] Add support for VPC flow logs in plain text file format #38897 (comment)

https://pkg.go.dev/strings#Cut should simplify this, something like:

for _, field := range fields {
	if logLine == "" {
		// handle field count mismatch
	}
	var value string
	value, logLine, _ = strings.Cut(logLine, " ")
}

Let's do that in a followup though.

Originally posted by @axw in #38897 (comment)

Describe alternatives you've considered

No response

Additional context

No response

[github-actions]

Pinging code owners:

• extension/encoding/awslogsencoding: @axw @constanca-m

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[axw]

Another couple of things to look into:

• Instead of collecting *srcaddr/*dstaddr addresses in a map, create a struct with the four possible fields
• VPC flow logs are already aggregated, so further grouping by resource may not be worth the cost

[axw]

/label -needs-triage