Documentation
¶
Index ¶
- Constants
- Variables
- func DetectFormat(msg string) string
- func MapFieldToLogLine(key string, value any, line *LogLine, config FieldMappingConfig) error
- func ParseAutodetect(line *LogLine)
- func ParseJSON(line *LogLine)
- func ParseKlogfmt(line *LogLine)
- func ParseLogfmt(line *LogLine)
- func ParseMessage(line *LogLine, format string)
- func ParseSyslog(line *LogLine)
- func SupportedFormats() []string
- func ValidateFormat(format string) error
- type FieldMappingConfig
- type LogLine
- func (t LogLine) EffectiveMessage(messageFields ...string) string
- func (t LogLine) GetFieldKey(fields []string, messageFields ...string) string
- func (t LogLine) GetFieldValue(field string, messageFields ...string) string
- func (t *LogLine) SetHash()
- func (t *LogLine) TemplateContext(messageFields ...string) map[string]any
- type LogResult
- type LogsRequestBase
Constants ¶
const ( FormatAutodetect = "autodetect" FormatJSON = "json" FormatKlogfmt = "klogfmt" FormatLogfmt = "logfmt" FormatSyslog = "syslog" )
Variables ¶
var DefaultMessageFields = []string{"msg", "message"}
Functions ¶
func DetectFormat ¶ added in v0.1.29
func MapFieldToLogLine ¶
func MapFieldToLogLine(key string, value any, line *LogLine, config FieldMappingConfig) error
MapFieldToLogLine maps a given key-value pair to the appropriate field in the LogLine struct based on the provided FieldMappingConfig.
func ParseAutodetect ¶ added in v0.1.29
func ParseAutodetect(line *LogLine)
func ParseKlogfmt ¶ added in v0.1.29
func ParseKlogfmt(line *LogLine)
func ParseLogfmt ¶ added in v0.1.29
func ParseLogfmt(line *LogLine)
func ParseMessage ¶ added in v0.1.29
func ParseSyslog ¶ added in v0.1.29
func ParseSyslog(line *LogLine)
func SupportedFormats ¶ added in v0.1.29
func SupportedFormats() []string
SupportedFormats returns the explicit formats ParseMessage accepts. An empty format is accepted too and means autodetect.
func ValidateFormat ¶ added in v0.1.29
ValidateFormat rejects a format ParseMessage would otherwise leave untouched. Empty is valid because it selects autodetection.
Types ¶
type FieldMappingConfig ¶
type FieldMappingConfig struct {
ID []string `json:"id,omitempty" yaml:"id,omitempty"`
Message []string `json:"message,omitempty" yaml:"message,omitempty"`
Timestamp []string `json:"timestamp,omitempty" yaml:"timestamp,omitempty"`
Host []string `json:"host,omitempty" yaml:"host,omitempty"`
Severity []string `json:"severity,omitempty" yaml:"severity,omitempty"`
Source []string `json:"source,omitempty" yaml:"source,omitempty"`
Ignore []string `json:"ignore,omitempty" yaml:"ignore,omitempty"`
}
FieldMappingConfig defines how source log fields map to canonical LogLine fields. Each key represents a canonical field (e.g., "message", "timestamp"), and the value is a list of possible source field names.
+kubebuilder:object:generate=true
func (*FieldMappingConfig) DeepCopy ¶
func (in *FieldMappingConfig) DeepCopy() *FieldMappingConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FieldMappingConfig.
func (*FieldMappingConfig) DeepCopyInto ¶
func (in *FieldMappingConfig) DeepCopyInto(out *FieldMappingConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (FieldMappingConfig) Empty ¶
func (c FieldMappingConfig) Empty() bool
func (FieldMappingConfig) WithDefaults ¶
func (c FieldMappingConfig) WithDefaults(defaultMap FieldMappingConfig) FieldMappingConfig
type LogLine ¶
type LogLine struct {
ID string `json:"id,omitempty"`
FirstObserved time.Time `json:"firstObserved,omitempty"`
LastObserved *time.Time `json:"lastObserved,omitempty"`
Count int `json:"count,omitempty"`
Message string `json:"message"`
Hash string `json:"hash,omitempty"`
Severity string `json:"severity,omitempty"`
Source string `json:"source,omitempty"`
Host string `json:"host,omitempty"`
Labels map[string]string `json:"labels,omitempty"`
}
func (LogLine) EffectiveMessage ¶ added in v0.1.29
EffectiveMessage is the line's message, falling back to the label a shipper may have carried it in when the body itself came through empty.
func (LogLine) GetFieldKey ¶ added in v0.1.29
func (LogLine) GetFieldValue ¶ added in v0.1.29
type LogsRequestBase ¶
type LogsRequestBase struct {
// The start time for the query
// SupportsDatemath
Start string `json:"start,omitempty"`
// The end time for the query
// Supports Datemath
End string `json:"end,omitempty"`
// Limit is the maximum number of lines to return
Limit string `json:"limit,omitempty" template:"true"`
}
func (*LogsRequestBase) GetStart ¶
func (r *LogsRequestBase) GetStart() (time.Time, error)
GetStart resolves the lower edge of the read window.
It goes through datetime.Parse rather than go-datemath directly because the two grammars are not the same: a bound written as date math ("now-1h") is go-datemath's, but a bound a profile parameter already resolved is an RFC3339Nano instant, and go-datemath's fraction stops at milliseconds — it rejects the very timestamps this package is handed.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
ABOUTME: Implements log searching against Azure Monitor Log Analytics workspaces.
|
ABOUTME: Implements log searching against Azure Monitor Log Analytics workspaces. |