[pkg/ottl] Add merge_all_maps

[strawgate]

Component(s)

No response

Is your feature request related to a problem? Please describe.

Right now merge_maps requires a source map and a target map.

There does not seem to be a good way to merge an array of maps.

Describe the solution you'd like

merge_all_maps(source, target, method)

where source is an array of maps and target is a map

Method (or whatever it's called on merge_map) would decide whether it's an insert, upset, etc

Describe alternatives you've considered

No response

Additional context

No response

[github-actions]

Pinging code owners:

• pkg/ottl: @TylerHelmuth @kentquirk @bogdandrutu @evan-bradley

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[evan-bradley]

@TylerHelmuth How would you feel about changing the source parameter in merge_maps to a list instead of a single value? This would be a huge breaking change, but would let us avoid having two editors. Maybe we could find a way to have a transition period.

[TylerHelmuth]

We could add a third, optional parameter like additionalMaps that is a list.

Technically the solution to this issue right now is to have multiple merge_maps statements in a row.

[strawgate]

I think the issue is that with things like Windows event data there are an arbitrary number of maps present in the array

[TylerHelmuth]

@strawgate interesting, can you go into more details about that use case?

[strawgate]

I detailed it here: #32952

Happy to include more info if you have specific questions