kelora 1.5.0

A command-line log analysis tool with embedded Rhai scripting
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

mod common;
use common::*;

/// Cascade mode: JSON lines parsed as JSON, everything else falls through to line.
#[test]
fn test_cascade_json_line_mixed() {
    let input = r#"{"level":"info","msg":"hello"}
plain text line
{"level":"error","msg":"oops"}
another plain line"#;

    let (stdout, stderr, exit_code) =
        run_kelora_with_input(&["-f", "json,line", "-F", "json"], input);
    assert_eq!(exit_code, 0, "cascade parsing should succeed: {}", stderr);

    let lines: Vec<&str> = stdout.trim().lines().collect();
    assert_eq!(lines.len(), 4, "should emit all 4 events");

    // Event 1: JSON - should have _format=json and the msg field
    let ev1: serde_json::Value = serde_json::from_str(lines[0]).unwrap();
    assert_eq!(ev1["_format"].as_str().unwrap(), "json");
    assert_eq!(ev1["msg"].as_str().unwrap(), "hello");

    // Event 2: plain text - should fall through to line
    let ev2: serde_json::Value = serde_json::from_str(lines[1]).unwrap();
    assert_eq!(ev2["_format"].as_str().unwrap(), "line");
    assert_eq!(ev2["line"].as_str().unwrap(), "plain text line");

    // Event 3: JSON again
    let ev3: serde_json::Value = serde_json::from_str(lines[2]).unwrap();
    assert_eq!(ev3["_format"].as_str().unwrap(), "json");
    assert_eq!(ev3["msg"].as_str().unwrap(), "oops");

    // Event 4: plain text again
    let ev4: serde_json::Value = serde_json::from_str(lines[3]).unwrap();
    assert_eq!(ev4["_format"].as_str().unwrap(), "line");
}

/// Filter on _format in cascade mode.
#[test]
fn test_cascade_filter_by_format() {
    let input = r#"{"msg":"json event"}
plain event
{"msg":"another json"}"#;

    let (stdout, _stderr, exit_code) = run_kelora_with_input(
        &[
            "-f",
            "json,line",
            "-F",
            "json",
            "--filter",
            "e._format == \"json\"",
        ],
        input,
    );
    assert_eq!(exit_code, 0);
    let lines: Vec<&str> = stdout.trim().lines().collect();
    assert_eq!(lines.len(), 2, "should only keep json events");
}

/// Cascade rejects schema-based formats.
#[test]
fn test_cascade_rejects_csv() {
    let (_stdout, stderr, exit_code) =
        run_kelora_with_input(&["-f", "json,csv", "-F", "json"], "{}");
    assert_ne!(exit_code, 0, "cascade with csv should fail");
    assert!(
        stderr.contains("csv") && stderr.to_lowercase().contains("cascade"),
        "error should mention csv and cascade: {}",
        stderr
    );
}

/// Cascade rejects auto inside the list.
#[test]
fn test_cascade_rejects_auto() {
    let (_stdout, stderr, exit_code) =
        run_kelora_with_input(&["-f", "auto,json", "-F", "json"], "{}");
    assert_ne!(exit_code, 0, "cascade with auto should fail");
    assert!(
        stderr.to_lowercase().contains("auto"),
        "error should mention auto: {}",
        stderr
    );
}

/// Cascade requires at least two formats.
#[test]
fn test_cascade_rejects_duplicates() {
    let (_stdout, stderr, exit_code) =
        run_kelora_with_input(&["-f", "json,json", "-F", "json"], "{}");
    assert_ne!(exit_code, 0, "cascade with duplicate should fail");
    assert!(
        stderr.to_lowercase().contains("duplicate"),
        "error should mention duplicate: {}",
        stderr
    );
}

/// Single format (no comma) still works as before — no _format field added.
#[test]
fn test_single_format_has_no_format_field() {
    let input = r#"{"msg":"hi"}"#;
    let (stdout, _stderr, exit_code) = run_kelora_with_input(&["-f", "json", "-F", "json"], input);
    assert_eq!(exit_code, 0);
    let ev: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert!(
        ev.get("_format").is_none(),
        "_format should not be added in single-format mode"
    );
}

/// Cascade diagnostics show per-format counts.
#[test]
fn test_cascade_diagnostic_counts() {
    let input = r#"{"a":1}
not json
{"b":2}"#;
    let (stdout, _stderr, exit_code) =
        run_kelora_with_input(&["-f", "json,line", "-F", "json", "--stats"], input);
    assert_eq!(exit_code, 0);
    assert!(
        stdout.contains("Cascade formats:")
            && stdout.contains("json=2")
            && stdout.contains("line=1"),
        "stats should include per-format cascade counts: {}",
        stdout
    );
}

/// Cascade works in parallel mode; per-worker counts merge into global stats.
#[test]
fn test_cascade_parallel_mode_merges_counts() {
    // Enough lines that parallel mode actually splits across workers.
    let mut input = String::new();
    for i in 0..200 {
        input.push_str(&format!("{{\"n\":{}}}\n", i));
        input.push_str("plain text line\n");
    }

    let (stdout, _stderr, exit_code) = run_kelora_with_input(
        &["-f", "json,line", "-F", "json", "--parallel", "--stats"],
        &input,
    );
    assert_eq!(exit_code, 0);
    // 200 json + 200 line events merged across workers
    assert!(
        stdout.contains("Cascade formats:")
            && stdout.contains("json=200")
            && stdout.contains("line=200"),
        "parallel stats should merge per-format counts: {}",
        stdout
    );
}