kelora 1.5.0

A command-line log analysis tool with embedded Rhai scripting
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

use crate::event::Event;
use crate::pipeline::EventParser;
use anyhow::Result;
use rhai::Dynamic;

pub struct LineParser;

impl LineParser {
    pub fn new() -> Self {
        Self
    }
}

impl EventParser for LineParser {
    fn parse(&self, line: &str) -> Result<Event> {
        let line = line.trim_end_matches('\n').trim_end_matches('\r');
        // Create event with minimal capacity (just the line field)
        let mut event = Event::with_capacity(line.to_string(), 1);

        // Set the line as a field so it's available as event["line"]
        event.set_field("line".to_string(), Dynamic::from(line.to_string()));

        Ok(event)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::pipeline::EventParser;

    #[test]
    fn test_line_parser_basic() {
        let parser = LineParser::new();
        let test_line = "This is a simple log line";
        let result = EventParser::parse(&parser, test_line).unwrap();

        // Should have the line available as a field
        assert!(result.fields.get("line").is_some());
        assert_eq!(
            result
                .fields
                .get("line")
                .unwrap()
                .clone()
                .into_string()
                .unwrap(),
            test_line
        );

        // Original line should also be preserved
        assert_eq!(result.original_line, test_line);

        // No timestamp should be extracted from plain text
        assert_eq!(result.parsed_ts, None);
    }

    #[test]
    fn test_line_parser_with_structure() {
        let parser = LineParser::new();
        let test_line = "2023-01-01 ERROR Failed to connect";
        let result = EventParser::parse(&parser, test_line).unwrap();

        // Should have the line available as a field
        assert!(result.fields.get("line").is_some());
        assert_eq!(
            result
                .fields
                .get("line")
                .unwrap()
                .clone()
                .into_string()
                .unwrap(),
            test_line
        );

        // Original line should be preserved
        assert_eq!(result.original_line, test_line);

        // Line parser doesn't extract timestamps
        assert_eq!(result.parsed_ts, None);
    }
}