Add literal Context Data (MDC) filtering to JSON Template Layout

[ramanathan1504]

Add allowed/disallowed literal key filters to JSON Template Layout's (Context Data) MDC and Map resolvers.

Update EcsLayout.json to prevent MDC entries from overwriting structural ECS fields.

Fixes #4166.

[ppkarwasz]

Hi @ramanathan1504,

Looks good to me, with two small comments:

[ramanathan1504]

@vy done — keyExcludes is gone, it's literal with allowed and disallowed now, and the grammar block in the ReadOnlyStringMapResolver javadoc is updated to match the one u pasted.

Two things your example didn't pin down: disallowed currently wins over allowed, and when pattern is also set a key has to satisfy both — is that what u meant, or should allowed widen the pattern instead?

[ramanathan1504]

@ppkarwasz reworked to the literal grammar @vy proposed on the issue, both your comments are still in — the sets are Collections.emptySet() when absent with @NonNull on the fields, and the benchmark compares two full layouts: 4.562 vs 1.833 ops/us.

A mis-shaped literal now throws the way flatten does, but a typo'd sub-key (disalowed) still parses and silently filters nothing — worth rejecting unknown keys under literal, or leave it as is?

[ppkarwasz]

Code looks good, but the naming for the configuration option seems odd. What about filter or keyFilter? The word literal doesn't tell me much, what this could do.

{
  "filter": {
    "includes": [
      "@timestamp",
      ...
    ]
  }
}

[vy]

I'd not use the word filter, it doesn't match what we already have: key and pattern, which both "filter".

@ramanathan1504, we had an internal conversation with @ppkarwasz, and agreed to overload key instead. That is, if key is of type string, use the existing behavior, if it is of type object, use the new semantics with allowed/disallowed. Would you mind updating the PR in that direction, please?

[ramanathan1504]

@vy de4101c literal is gone, key takes a string (unchanged) or an object with allowed/disallowed. The object form combines with pattern/flatten and disallowed wins over allowed. tell me if u meant allowed to widen the pattern.