fix(enrichment): look for service as key, not as value in extracted d…

…dtags

aws/logs_monitoring/steps/enrichment.py

@@ -154,7 +154,7 @@ def extract_ddtags_from_message(event):
                 return
 
         # Extract service tag from message.ddtags if exists
-        if "service" in extracted_ddtags:
+        if "service:" in extracted_ddtags:
             event[DD_SERVICE] = next(
                 tag[8:]
                 for tag in extracted_ddtags.split(",")

aws/logs_monitoring/tests/test_enrichment.py

@@ -107,6 +107,21 @@ def test_extract_ddtags_from_message_multiple_values_tag(self):
             "my_application_service",
         )
 
+    def test_extract_ddtags_from_message_service_only_in_extracted_ddtags_values(self):
+        loaded_message_tags = {"ddtags": "key:my-service-repo"}
+        event = {"message": loaded_message_tags, "ddtags": self.custom_tags}
+
+        extract_ddtags_from_message(event)
+
+        self.assertEqual(
+            event["ddtags"],
+            "custom_tag_2:value2,service:my_custom_service,key:my-service-repo",
+        )
+        self.assertNotIn(
+            "service",
+            event,
+        )
+
 
 class TestExtractHostFromLogEvents(unittest.TestCase):
     def test_parse_source_cloudtrail(self):