scouty 0.3.2

Log parsing, filtering, and analysis library
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

//! FilterEngine — manages exclude/include filters and produces a filtered view.

use crate::filter::expr;
use crate::filter::expr_filter::ExprFilter;
use crate::record::LogRecord;
use crate::traits::LogFilter;
use tracing::{instrument, warn};

/// The action to take when a filter matches.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum FilterAction {
    /// Exclude matching records.
    Exclude,
    /// Include matching records.
    Include,
}

/// A filter with an associated action.
#[derive(Debug)]
pub struct FilterEntry {
    pub action: FilterAction,
    pub filter: Box<dyn LogFilter>,
}

/// Manages all filters and applies exclude-first → include logic.
#[derive(Debug)]
pub struct FilterEngine {
    filters: Vec<FilterEntry>,
}

impl FilterEngine {
    pub fn new() -> Self {
        Self {
            filters: Vec::new(),
        }
    }

    /// Add a filter with the given action.
    pub fn add_filter(&mut self, action: FilterAction, filter: Box<dyn LogFilter>) {
        self.filters.push(FilterEntry { action, filter });
    }

    /// Add a filter from an expression string.
    ///
    /// Parses and validates the expression, then wraps it as a `LogFilter`.
    #[instrument(skip(self), fields(expression))]
    pub fn add_expr_filter(
        &mut self,
        action: FilterAction,
        expression: &str,
    ) -> Result<(), String> {
        let parsed = expr::parse(expression)?;
        expr::validate(&parsed)?;
        self.add_filter(action, Box::new(ExprFilter::new(parsed, expression)));
        Ok(())
    }

    /// Remove all filters.
    pub fn clear(&mut self) {
        self.filters.clear();
    }

    /// Check if a single record passes all filters.
    ///
    /// Same logic as `apply_iter` but for one record.
    pub fn matches(&self, record: &LogRecord) -> bool {
        // Step 1: check excludes
        for entry in &self.filters {
            if entry.action == FilterAction::Exclude && entry.filter.matches(record) {
                return false;
            }
        }
        // Step 2: check includes
        let has_includes = self
            .filters
            .iter()
            .any(|e| e.action == FilterAction::Include);
        if has_includes {
            self.filters
                .iter()
                .any(|e| e.action == FilterAction::Include && e.filter.matches(record))
        } else {
            true
        }
    }

    /// Apply all filters to the records.
    /// Returns indices of records that pass the filter pipeline.
    ///
    /// Logic:
    /// 1. Any record matching an Exclude filter is excluded.
    /// 2. If there are Include filters, only records matching at least one are included.
    /// 3. If there are no Include filters, all non-excluded records are included.
    #[instrument(skip(self, records), fields(record_count = records.len()))]
    pub fn apply(&self, records: &[LogRecord]) -> Vec<usize> {
        self.apply_iter(records.iter())
    }

    /// Apply all filters using an iterator over records.
    /// Returns indices of records that pass the filter pipeline.
    pub fn apply_iter<'a>(&self, records: impl Iterator<Item = &'a LogRecord>) -> Vec<usize> {
        let excludes: Vec<&dyn LogFilter> = self
            .filters
            .iter()
            .filter(|e| e.action == FilterAction::Exclude)
            .map(|e| e.filter.as_ref())
            .collect();

        let includes: Vec<&dyn LogFilter> = self
            .filters
            .iter()
            .filter(|e| e.action == FilterAction::Include)
            .map(|e| e.filter.as_ref())
            .collect();

        let has_includes = !includes.is_empty();

        records
            .enumerate()
            .filter(|(_, record)| {
                // Step 1: check excludes
                if excludes.iter().any(|f| f.matches(record)) {
                    return false;
                }
                // Step 2: check includes
                if has_includes {
                    includes.iter().any(|f| f.matches(record))
                } else {
                    true
                }
            })
            .map(|(i, _)| i)
            .collect()
    }
}

impl Default for FilterEngine {
    fn default() -> Self {
        Self::new()
    }
}

#[cfg(test)]
#[path = "engine_tests.rs"]
mod engine_tests;