pub struct LogEntry {
pub timestamp: Option<String>,
pub level: Option<String>,
pub message: Option<String>,
pub tag: Option<String>,
pub fields: Map<String, Value>,
pub raw: String,
}Expand description
A single structured log entry.
All four known fields are Option<String> because a JSON line may omit
any of them and still be worth indexing — the parser’s contract per the
milestone 1 spec is “missing optional fields use None not panic”.
fields holds only keys that are not among the known four. The parser
is responsible for lifting known keys out of the JSON object and into
their dedicated fields before populating this map.
Fields§
§timestamp: Option<String>The entry’s timestamp as it appeared in the source line. Stored as a
string rather than a parsed DateTime so unusual formats survive
ingestion; time-range filtering is applied at query time.
level: Option<String>Log severity (“error”, “warn”, “info”, …). Indexed column.
message: Option<String>The human-readable message body.
tag: Option<String>Optional source tag supplied at ingestion time (the --tag CLI flag,
per the “Decisions log” entry on optional tags). None means
“untagged” and such entries match queries without a tag filter.
fields: Map<String, Value>Arbitrary additional keys from the JSON object. Serialized to the
fields TEXT column and queried via SQLite’s json_extract().
raw: StringThe original, unmodified source line. Feeds both the raw column
and the blake3-based dedup hash.
Implementations§
Source§impl LogEntry
impl LogEntry
Sourcepub const KNOWN_KEYS: &'static [&'static str]
pub const KNOWN_KEYS: &'static [&'static str]
The set of top-level JSON keys that are promoted to first-class
struct fields during parsing. Any key not in this set is preserved
in LogEntry::fields.
Kept in a single place so the parser and any future schema-related code agree on which keys are “known”.