1943667 - Index last_error_value and make it available for search

Status: RESOLVED FIXED

(Socorro :: Processor, enhancement, P3)

Description

[Gabriele Svelto [:gsvelto]]

We've been surfacing the last_error_value for a while and it proved quite useful in debugging Windows crashes. It would be useful to be able to search it, aggregate it, etc... when analyzing crashes.

Comment 1

[Will Kahn-Greene [:willkg] ET needinfo? me]

By last_error_value, Gabriele probably means the one in the crashing_thread structure of the stackwalker output.

We already have it in the processed crash schema:

https://github.com/mozilla-services/socorro/blob/09620f6abd1c50be423e9f45e3f2b0f6ca87ba84/socorro/schemas/processed_crash.schema.yaml#L318-L321

Steps here:

1. write a processor rule to extract it so it's at the top level of the crash report -- we need to do this because we don't want to index anything that isn't at the top level of the crash report and has been validated and normalized
2. add the field to super search fields

Here's an example crash report: https://crash-stats.mozilla.org/report/index/a44e6991-cb5b-4495-a9af-e79a50250321

Value is: ERROR_COMMITMENT_LIMIT

Assuming they're all like that, we should index this as a keyword.

Comment 2

[Will Kahn-Greene [:willkg] ET needinfo? me]

Attachment: [mozilla-services/socorro] bug-1943667: add search support for last_error_value (#6946)

Comment 3

[Will Kahn-Greene [:willkg] ET needinfo? me]

willkg merged PR [mozilla-services/socorro]: bug-1943667: add search support for last_error_value (#6946) in 376df40.

Comment 4

[Sven Marnach :sven]

This was deployed to prod in https://github.com/mozilla-services/socorro/releases/tag/v2025.03.27.

I tried a search in production with last_error_value as a facet, but currently I can't see any results: https://crash-stats.mozilla.org/search/?date=%3E%3D2024-09-28T11%3A58%3A00.000Z&date=%3C2025-03-28T11%3A58%3A00.000Z&_facets=signature&_facets=last_error_value&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-last_error_value

I submitted a44e6991-cb5b-4495-a9af-e79a50250321 for reprocessing and will try again once that crash report has been processed again.

Comment 5

[Sven Marnach :sven]

I learned from Will that I need to wait for a new Elasticsearch index to be built, which will only be available on Monday.

Comment 6

[Sven Marnach :sven]

This looks like it's working fine now: https://crash-stats.mozilla.org/search/?date=%3E%3D2025-03-28T09%3A41%3A00.000Z&date=%3C2025-03-31T09%3A41%3A00.000Z&_facets=last_error_value&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-last_error_value

Comment 7

[Gabriele Svelto [:gsvelto]]

Thanks Sven, this is very useful!