Documentation
¶
Index ¶
- Variables
- func DefaultPluginDir() string
- func FormatNames() []string
- func LoadCloudWatchJSON(r io.Reader) ([]LogRecord, int, Format, error)
- func LoadPlugins()
- func LoadPluginsFrom(dir string) []string
- func RegisterFormat(f Format)
- type Attrs
- type CLFFormat
- type CloudWatchFormat
- type DocumentFormat
- type Format
- type GlogFormat
- type JSONFormat
- type KeyValue
- type LogFile
- type LogRecord
- type LogfmtFormat
- type RegexFormat
- type WASMFormat
Constants ¶
This section is empty.
Variables ¶
var Formats = []Format{ &JSONFormat{}, &GlogFormat{}, &CLFFormat{}, &LogfmtFormat{}, &CloudWatchFormat{}, }
Formats is the registry of known formats, in auto-detection priority order. More specific formats (JSON, glog, CLF) are tried before the permissive logfmt parser, which accepts almost anything with key=value pairs. CloudWatch is listed for --format lookup but not in line-by-line detection (it needs special document-level handling).
Functions ¶
func DefaultPluginDir ¶
func DefaultPluginDir() string
func LoadCloudWatchJSON ¶
LoadCloudWatchJSON reads a complete CloudWatch JSON document (from aws logs filter-log-events or get-log-events) and returns parsed records.
func LoadPlugins ¶
func LoadPlugins()
func LoadPluginsFrom ¶
func RegisterFormat ¶
func RegisterFormat(f Format)
RegisterFormat adds a format to the registry. Plugin formats are appended after built-ins, so built-in formats always have detection priority.
Types ¶
type Attrs ¶
type Attrs []KeyValue
Attrs is a slice of key-value pairs in insertion order.
type CloudWatchFormat ¶
type CloudWatchFormat struct{}
CloudWatchFormat parses AWS CloudWatch Logs output. Handles both `aws logs filter-log-events` JSON output (document with events array) and `aws logs tail` line-by-line output (timestamp + stream + message).
func (*CloudWatchFormat) IsDocumentFormat ¶
func (f *CloudWatchFormat) IsDocumentFormat()
func (*CloudWatchFormat) Name ¶
func (f *CloudWatchFormat) Name() string
func (*CloudWatchFormat) ParseRecord ¶
func (f *CloudWatchFormat) ParseRecord(line string) (LogRecord, error)
ParseRecord handles a single `aws logs tail` line: 2024-01-15T10:30:00+00:00 log-group/log-stream message...
type DocumentFormat ¶
type DocumentFormat interface {
Format
IsDocumentFormat()
}
DocumentFormat is implemented by formats that parse whole documents rather than individual lines (e.g. CloudWatch JSON). Document formats are skipped during line-by-line auto-detection.
type Format ¶
Format parses log lines into LogRecords.
func DetectFormat ¶
DetectFormat reads up to detectSampleSize non-empty lines from the reader and tries each format. Returns the first format that parses >50% of the sample lines, along with the sampled lines (so the caller doesn't lose them).
func FormatByName ¶
FormatByName returns the format with the given name, or nil.
type GlogFormat ¶
type GlogFormat struct{}
GlogFormat parses glog/klog format log lines. Format: Lmmdd hh:mm:ss.uuuuuu threadid file:line] message L is a single letter: I=INFO, W=WARNING, E=ERROR, F=FATAL
func (*GlogFormat) Name ¶
func (f *GlogFormat) Name() string
func (*GlogFormat) ParseRecord ¶
func (f *GlogFormat) ParseRecord(line string) (LogRecord, error)
type JSONFormat ¶
type JSONFormat struct{}
JSONFormat parses JSON log lines, auto-detecting common field name variants for time, level, and message across slog, zap, zerolog, logrus, bunyan, and docker.
func (*JSONFormat) Name ¶
func (f *JSONFormat) Name() string
func (*JSONFormat) ParseRecord ¶
func (f *JSONFormat) ParseRecord(line string) (LogRecord, error)
type LogFile ¶
type LogFile struct {
Records []LogRecord
Skipped int
Format Format
// contains filtered or unexported fields
}
LogFile holds the records loaded from a log file. Call Close when done to release resources (e.g. munmap the backing file).
func Load ¶
Load reads a log file, auto-detecting the format or using the given one. The file is mmap'd on supported platforms so that the OS pages it in lazily without loading the entire file into the Go heap. Call Close on the returned LogFile to release the mapping.
func LoadReader ¶
LoadReader reads log lines from a reader, auto-detecting the format or using the given one. All data is read into memory at once.
type LogRecord ¶
LogRecord represents a single structured log entry.
func ParseRecord ¶
ParseRecord parses a single JSON log line into a LogRecord. This is a convenience wrapper around JSONFormat for backward compatibility.
type LogfmtFormat ¶
type LogfmtFormat struct{}
func (*LogfmtFormat) Name ¶
func (f *LogfmtFormat) Name() string
func (*LogfmtFormat) ParseRecord ¶
func (f *LogfmtFormat) ParseRecord(line string) (LogRecord, error)
type RegexFormat ¶
type RegexFormat struct {
// contains filtered or unexported fields
}
func (*RegexFormat) Name ¶
func (f *RegexFormat) Name() string
func (*RegexFormat) ParseRecord ¶
func (f *RegexFormat) ParseRecord(line string) (LogRecord, error)
type WASMFormat ¶
type WASMFormat struct {
// contains filtered or unexported fields
}
WASMFormat implements Format by delegating to a WASM module that exports the hustle plugin ABI: name, parse, alloc, dealloc.
func (*WASMFormat) Close ¶
func (f *WASMFormat) Close() error
Close releases the WASM runtime resources.
func (*WASMFormat) Name ¶
func (f *WASMFormat) Name() string
func (*WASMFormat) ParseRecord ¶
func (f *WASMFormat) ParseRecord(line string) (LogRecord, error)
Source Files