Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

agentdrain

package

Go to main page

Versions in this module

v0

v0.67.3

Apr 8, 2026

v0.67.2

Apr 6, 2026

v0.67.1

Apr 6, 2026

v0.67.0

Apr 5, 2026

v0.66.1

Apr 3, 2026

v0.66.0

Apr 3, 2026

Changes in this version

+ func FlattenEvent(evt AgentEvent, excludeFields []string) string

+ func StageSequence(events []AgentEvent) string

+ func Tokenize(line string) []string

+ type AgentEvent struct

+ Fields map[string]string

+ Stage string

+ type AnomalyDetector struct

+ func NewAnomalyDetector(simThreshold float64, rareClusterThreshold int) *AnomalyDetector

+ func (d *AnomalyDetector) Analyze(result *MatchResult, isNew bool, cluster *Cluster) *AnomalyReport

+ type AnomalyReport struct

+ AnomalyScore float64

+ IsNewTemplate bool

+ LowSimilarity bool

+ NewClusterCreated bool

+ RareCluster bool

+ Reason string

+ type Cluster struct

+ ID int

+ Size int

+ Stage string

+ Template []string

+ type Config struct

+ Depth int

+ ExcludeFields []string

+ MaskRules []MaskRule

+ MaxChildren int

+ ParamToken string

+ RareClusterThreshold int

+ SimThreshold float64

+ func DefaultConfig() Config

+ type Coordinator struct

+ func NewCoordinator(cfg Config, stages []string) (*Coordinator, error)

+ func (c *Coordinator) AllClusters() map[string][]Cluster

+ func (c *Coordinator) AnalyzeEvent(evt AgentEvent) (*MatchResult, *AnomalyReport, error)

+ func (c *Coordinator) LoadDefaultWeights() error

+ func (c *Coordinator) LoadSnapshots(snapshots map[string][]byte) error

+ func (c *Coordinator) LoadWeightsJSON(data []byte) error

+ func (c *Coordinator) MinerForStage(stage string) (*Miner, bool)

+ func (c *Coordinator) SaveSnapshots() (map[string][]byte, error)

+ func (c *Coordinator) SaveWeightsJSON() ([]byte, error)

+ func (c *Coordinator) Stages() []string

+ func (c *Coordinator) TrainEvent(evt AgentEvent) (*MatchResult, error)

+ type MaskRule struct

+ Name string

+ Pattern string

+ Replacement string

+ type Masker struct

+ func NewMasker(rules []MaskRule) (*Masker, error)

+ func (m *Masker) Mask(line string) string

+ type MatchResult struct

+ ClusterID int

+ Params []string

+ Similarity float64

+ Stage string

+ Template string

+ type Miner struct

+ func LoadMinerJSON(data []byte) (*Miner, error)

+ func NewMiner(cfg Config) (*Miner, error)

+ func (m *Miner) AnalyzeEvent(evt AgentEvent) (*MatchResult, *AnomalyReport, error)

+ func (m *Miner) ClusterCount() int

+ func (m *Miner) Clusters() []Cluster

+ func (m *Miner) LoadJSON(data []byte) error

+ func (m *Miner) Match(line string) (*MatchResult, bool, error)

+ func (m *Miner) PreTrainTemplate(template string, count int)

+ func (m *Miner) PreTrainTemplateCounts(templates map[string]int)

+ func (m *Miner) PreTrainTemplates(templates []string)

+ func (m *Miner) SaveJSON() ([]byte, error)

+ func (m *Miner) Train(line string) (*MatchResult, error)

+ func (m *Miner) TrainEvent(evt AgentEvent) (*MatchResult, error)

+ type Snapshot struct

+ Clusters []SnapshotCluster

+ Config Config

+ NextID int

+ type SnapshotCluster struct

+ ID int

+ Size int

+ Stage string

+ Template []string