Skip to content

[BUG] DBM query obfuscator incorrectly parameterizes EXTRACT field keywords, splitting one query into two signatures #49420

@dlants

Description

@dlants

Agent version

7.72.4

Bug Report

We're seeing a single PostgreSQL query appear as two distinct query signatures in Database Monitoring because the SQL obfuscator inconsistently handles the epoch keyword in EXTRACT(epoch FROM ...) expressions.

EXTRACT(epoch FROM ...) is standard PostgreSQL syntax where epoch is a SQL keyword, not a user-supplied literal. However, the obfuscator sometimes replaces it with ?, producing EXTRACT(? FROM ...). This creates two normalized forms for the same underlying query:

  • Signature A: ... EXTRACT ( epoch FROM assay_result.created_at ) ...
  • Signature B: ... EXTRACT ( ? FROM assay_result.created_at ) ...

We believe queries captured via pg_stat_statements preserve the epoch keyword (since Postgres normalizes first and leaves keywords intact), while queries captured via pg_stat_activity (live samples) go through the agent's own obfuscation pass which misclassifies epoch as a replaceable literal.

Consequently, query metrics (latency, calls, rows) are split across two signatures, making it difficult to assess the true volume and performance of this query.

The obfuscator should recognize epoch (and other EXTRACT field keywords like dow, doy, isodow, microseconds, milliseconds, quarter, etc.) as SQL keywords and preserve them during normalization, producing a query signature consistent with Postgres normalization.

Reproduction Steps

No response

Agent configuration

No response

Operating System

No response

Other environment details

We're capturing metrics from an Amazon RDS PostgresQL instance

Metadata

Metadata

Assignees

No one assigned

    Labels

    oss/0External contributions priority 0pendingLabel for issues waiting a Datadog member's response.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions