Safely extractt service tag (#511)

* Safely extractt service tag

* Add tests

Author: tianchu

aws/logs_monitoring/parsing.py

@@ -220,9 +220,8 @@ def get_service_from_tags(metadata):
     # Get service from dd_custom_tags if it exists
     tagsplit = metadata[DD_CUSTOM_TAGS].split(",")
     for tag in tagsplit:
-        tag_name, tag_value = tag.split(":")
-        if tag_name == "service":
-            return tag_value
+        if tag.startswith("service:"):
+            return tag[8:]
 
     # Default service to source value
     return metadata[DD_SOURCE]

aws/logs_monitoring/tests/test_parsing.py

@@ -20,6 +20,11 @@
     parse_event_source,
     separate_security_hub_findings,
     parse_aws_waf_logs,
+    get_service_from_tags,
+)
+from settings import (
+    DD_CUSTOM_TAGS,
+    DD_SOURCE,
 )
 
 env_patch.stop()
@@ -718,5 +723,21 @@ def test_awslogs_handler_rds_postgresql(self):
         )
 
 
+class TestGetServiceFromTags(unittest.TestCase):
+    def test_get_service_from_tags(self):
+        metadata = {
+            DD_SOURCE: "ecs",
+            DD_CUSTOM_TAGS: "env:dev,tag,stack:aws:ecs,service:web,version:v1",
+        }
+        self.assertEqual(get_service_from_tags(metadata), "web")
+
+    def test_get_service_from_tags_default_to_source(self):
+        metadata = {
+            DD_SOURCE: "ecs",
+            DD_CUSTOM_TAGS: "env:dev,tag,stack:aws:ecs,version:v1",
+        }
+        self.assertEqual(get_service_from_tags(metadata), "ecs")
+
+
 if __name__ == "__main__":
     unittest.main()