kql-panopticon 0.3.0

KQL tooling for Azure Log Analytics - concurrent multi-workspace queries, chained investigations, HTTP enrichment, and automated reports
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

mod cli;
mod client;
mod error;
mod investigation;
mod investigation_pack;
mod query_job;
mod query_pack;
mod session;
mod tui;
mod workspace;

use clap::Parser;
use cli::args::{Cli, Commands, PackFormat};
use client::Client;
use error::Result;
use std::fs::OpenOptions;

#[tokio::main]
async fn main() -> Result<()> {
    let cli = Cli::parse();

    match cli.command {
        None | Some(Commands::Tui) => {
            // Launch TUI (existing behavior)
            initialize_logger_to_file();
            let client = Client::new()?;
            tui::run_tui(client).await?;
        }
        Some(Commands::RunPack {
            pack,
            workspaces,
            format,
            json,
            validate_only,
        }) => {
            initialize_logger_to_stderr();
            cli::run_pack::execute(pack, workspaces, format, json, validate_only).await?;
        }
        Some(Commands::ExportPack {
            session,
            output,
            format,
        }) => {
            initialize_logger_to_stderr();
            let pack_format = match format {
                PackFormat::Yaml => cli::export_pack::PackFormat::Yaml,
                PackFormat::Json => cli::export_pack::PackFormat::Json,
            };
            cli::export_pack::execute(session, output, pack_format)?;
        }
        Some(Commands::RunInvestigation {
            pack,
            workspaces,
            inputs,
            output,
            validate_only,
            json,
        }) => {
            initialize_logger_to_stderr();
            cli::run_investigation::execute(pack, workspaces, inputs, output, validate_only, json)
                .await?;
        }
    }

    Ok(())
}

fn initialize_logger_to_file() {
    let log_file = OpenOptions::new()
        .create(true)
        .append(true)
        .open("kql-panopticon.log")
        .expect("Failed to open log file");

    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info"))
        .target(env_logger::Target::Pipe(Box::new(log_file)))
        .init();
}

fn initialize_logger_to_stderr() {
    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("warn")).init();
}