logfwd

type Config struct {
	// Enabled controls whether log forwarding is active.
	// Default: true (set by ApplyDefaults).
	Enabled bool `yaml:"enabled"`

	// CollectInterval is the interval between collection cycles.
	// Must be at least 5s.
	CollectInterval time.Duration `yaml:"collect_interval"`

	// ReportInterval is the interval between reporting to the control plane.
	// Must be >= CollectInterval.
	ReportInterval time.Duration `yaml:"report_interval"`

	// BatchSize is the maximum number of log entries per report batch.
	// Must be at least 1. Default: 200.
	BatchSize int `yaml:"batch_size"`

	// FilePatterns is a list of glob patterns for file-based log collection.
	// Example: ["/var/log/app/*.log", "/var/log/syslog"]
	FilePatterns []string `yaml:"file_patterns"`

	// Filter defines optional log filtering rules.
	// When non-empty, the Forwarder wraps sources with a FilteringSource.
	Filter FilterConfig `yaml:"filter"`

	// LocalEndpoint configures an optional local data-plane endpoint.
	LocalEndpoint api.LocalEndpointConfig `yaml:"local_endpoint"`
}

type FileSource struct {
	// contains filtered or unexported fields
}

type FilterConfig struct {
	// MinSeverity drops entries below this severity level.
	// Empty string means no severity filtering.
	MinSeverity string `yaml:"min_severity"`

	// IncludeUnits, if non-empty, only passes entries matching one of these unit names.
	IncludeUnits []string `yaml:"include_units"`

	// ExcludeUnits drops entries matching any of these unit names.
	ExcludeUnits []string `yaml:"exclude_units"`
}

type FilteringSource struct {
	// contains filtered or unexported fields
}

type Forwarder struct {
	// contains filtered or unexported fields
}

type JournalEntry struct {
	Timestamp time.Time
	Message   string
	Priority  int
	Unit      string
}

type JournalReader interface {
	ReadEntries(ctx context.Context) ([]JournalEntry, error)
}

type JournalctlReader struct {
	// contains filtered or unexported fields
}

type JournaldSource struct {
	// contains filtered or unexported fields
}

type LocalReporter struct {
	// contains filtered or unexported fields
}

type LogReporter interface {
	ReportLogs(ctx context.Context, nodeID string, batch api.LogBatch) error
}

type LogSource interface {
	Collect(ctx context.Context) ([]api.LogEntry, error)
}

type MultiReporter struct {
	// contains filtered or unexported fields
}

type RingBuffer struct {
	// contains filtered or unexported fields
}

type SecretFetcher interface {
	FetchSecret(ctx context.Context, nodeID, key string) (*api.SecretResponse, error)
}