Expand description
log_field_fold transform (canonical id "log_field_fold", v1.0.0).
Content-aware, losslessly reversible structural compression for line-oriented text
(InputFormat::PlainText / CommandOutput). It is the log-line analogue of
json_field_fold: where that folds arrays of homogeneous objects by
emitting each repeated key once, this folds runs of templated log lines by emitting each
repeated line template once.
Most log lines share a fixed skeleton and vary only in a few fields (timestamps, ids, counts):
2026-07-01T10:05:11Z req=req-0311 status=200 ms=41
2026-07-01T10:05:12Z req=req-0312 status=200 ms=44Replacing each variable token (a run of digits, or a 0x… hex literal) with a placeholder
yields one shared template 2026-\x00-\x00T\x00:\x00:\x00Z req=req-\x00 status=\x00 ms=\x00
plus a per-line tuple of the captured values. The fold emits every distinct template once and
a compact row per original line (template_id + its captured values), so the skeleton text is
paid for once instead of per line — a large win on repetitive logs, unlike
log_compaction which only collapses identical adjacent lines.
It is a pure structural rewrite: unfold_log reconstructs the original bytes exactly, and the
pipeline gates adoption on that round-trip (round_trips) — a fold that would ever lose data
(or a genuine input that happens to look like our framing) is rolled back rather than emitted.
Constants§
- TRANSFORM_
ID - Canonical transform id, as registered with the pipeline.
- TRANSFORM_
VERSION - Semantic version of this transform’s output behavior.
Functions§
- fold_
log - Folds runs of templated lines in
inputinto a header + a JSON array of distinct templates + one compact row (template_idthen captured values) per original line. Returnsinputunchanged when folding cannot help (too few lines, no shared templates, or a line contains the placeholder char). Never panics. - round_
trips - True iff unfolding
afterreproducesbeforeexactly. The pipeline’s safety gate for this transform — folding is only adopted when this holds. - unfold_
log - Inverse of
fold_log: expands a folded blob back to the original text. Returnsinputunchanged if it is not a well-formed folded blob (so a genuine log that merely starts with the header is not mangled — the pipeline’sround_tripsgate makes that safe either way).