anchored

Overview ¶

Package anchored demonstrates pkg/eventlog over Anchored data: a log index read the way Elasticsearch (behind ECK) is read past its first 10,000 hits — with search_after, over HTTP, against demoapi's POST /logs-app/_search. There are no offsets and no total, only "the page older than these sort values" and "the page newer than those", so the eventlog holds a span grown at whichever edge the viewport nears, trimmed at the far end past 5,000 documents.

The index holds 20,000 documents and keeps receiving more, so the view opens at the newest and follows. The screen is bound with pkg/remote and writes only the search client, which is shaped like one for a real cluster:

• The cursor is a hit's sort values, @timestamp and the _shard_doc tiebreaker; several documents share a timestamp, so paging on the timestamp alone would lose the ones at a page's edge.
• Older pages are the same query with the sort reversed, the hits put back in time order.
• Tailing newer documents rewinds a few seconds past the edge: some arrive after their own @timestamp, and a tail strictly after the newest one held would never see them. The eventlog drops the repeats by key.
• Whether an edge has more is asked for, not computed: one hit more than the page.
• A search hit beyond the span re-anchors there — the span is replaced by the hit and its surroundings, Kibana's "surrounding documents" — and the binding does that part.
• The action menu jumps: to the newest document, the oldest, or a time, each one SetAnchor. A time is a cursor no document has — the sort values just past it — so the view lands on the newest document at or before it.

The gutter shows each document's @timestamp: the server's time for the event, not the TUI's. Enter opens a document; L cycles latency.