Is it possible for a DataCooker to use the built-in ETW pipeline as source?

[jalfd]

I'm looking into writing a plugin which takes generic ETW events and uses them to populate a custom table.
It looks like this should be possible by defining a DataCooker which uses one of the DataCookers that WPA ships with as its source. But which one? Are these documented somewhere? Is this intended to be possible, or should plugins load their own data from scratch and effectively reimplement the entire ETW pipeline?

Some background for what I really want to achieve: I have an application which emits custom ETW events, and I can visualize these in WPA's Generic Events table, but I'd like to be able to visualize them as spans with a begin/end time. As far as I can tell this cannot be configured in WPA on an existing view, so I would instead have to write a plugin which takes the ETW data, cooks it and feeds it into a custom table definition, assigning appropriate roles to the individual columns. But to do that, I would either need to write the entire pipeline, loading the .etl file and parsing myself, or I would need to use one of the standard DataCookers to use as my source, and for that I need to know the DataCooker path and type.

How would I achieve any of this? If I'm way off and a completely different approach should be used, any pointers would be welcome too. :)

[mslukebo]

Thanks for your question @jalfd!

Before diving into your questions about plugin authoring and DataCookers, I am wondering if you can solve your goal with WPA's Regions of Interest feature. With this feature, you can author a file that describes how certain events correspond to specific regions of time that should be grouped together in WPA.

[jalfd]

Before diving into your questions about plugin authoring and DataCookers, I am wondering if you can solve your goal with WPA's Regions of Interest feature. With this feature, you can author a file that describes how certain events correspond to specific regions of time that should be grouped together in WPA.

Thanks for the suggestion. I was able to approximate what I want using Regions of Interest. I did run into a few limitations I couldn't figure out good ways around though.

Out of curiosity, both to work around those limitations and because I'd like to understand more of ETW and WPA, is the approach I initially suggested, of writing a WPA plugin which sources the existing ETW pipeline and builds a custom table from those events viable at all?

I don't expect you to spend time writing out detailed steps on how to accomplish that of course, but I would be interested to know if that is something that is intended to be possible (for non-Microsofties) at all, and if so, if you have any quick tips to point me in the right direction.

Thanks in advance!

[mslukebo]

Unfortunately it is not currently possible to do what your original question asked, but is something we want to support in the long term. Specifically, when you ask:

It looks like this should be possible by defining a DataCooker which uses one of the DataCookers that WPA ships with as its source.

The DataCooker framework was indeed designed to facilitate this use case of sharing DataCooker outputs between independently loaded plugins. However, there is still a backlog of feature work that needs to be done to fully support the scenario. For instance. the plugins system features introduced in SDK version 1.2 was one of the first major steps towards this milestone

To answer the remaining parts of your question:

But which one? Are these documented somewhere?

Currently ETW cooker IDs and types are not documented, but once we fully support this scenario they will be.

should plugins load their own data from scratch and effectively reimplement the entire ETW pipeline?

Yes, that is currently the approach plugin authors should take if they are attempting to augment the ETW processing pipeline.