Skip to main content

Module log_fold

Module log_fold 

Source
Expand description

log_field_fold transform (canonical id "log_field_fold", v1.0.0).

Content-aware, losslessly reversible structural compression for line-oriented text (InputFormat::PlainText / CommandOutput). It is the log-line analogue of json_field_fold: where that folds arrays of homogeneous objects by emitting each repeated key once, this folds runs of templated log lines by emitting each repeated line template once.

Most log lines share a fixed skeleton and vary only in a few fields (timestamps, ids, counts):

2026-07-01T10:05:11Z req=req-0311 status=200 ms=41
2026-07-01T10:05:12Z req=req-0312 status=200 ms=44

Replacing each variable token (a run of digits, or a 0x… hex literal) with a placeholder yields one shared template 2026-\x00-\x00T\x00:\x00:\x00Z req=req-\x00 status=\x00 ms=\x00 plus a per-line tuple of the captured values. The fold emits every distinct template once and a compact row per original line (template_id + its captured values), so the skeleton text is paid for once instead of per line — a large win on repetitive logs, unlike log_compaction which only collapses identical adjacent lines.

It is a pure structural rewrite: unfold_log reconstructs the original bytes exactly, and the pipeline gates adoption on that round-trip (round_trips) — a fold that would ever lose data (or a genuine input that happens to look like our framing) is rolled back rather than emitted.

Constants§

TRANSFORM_ID
Canonical transform id, as registered with the pipeline.
TRANSFORM_VERSION
Semantic version of this transform’s output behavior.

Functions§

fold_log
Folds runs of templated lines in input into a header + a JSON array of distinct templates + one compact row (template_id then captured values) per original line. Returns input unchanged when folding cannot help (too few lines, no shared templates, or a line contains the placeholder char). Never panics.
round_trips
True iff unfolding after reproduces before exactly. The pipeline’s safety gate for this transform — folding is only adopted when this holds.
unfold_log
Inverse of fold_log: expands a folded blob back to the original text. Returns input unchanged if it is not a well-formed folded blob (so a genuine log that merely starts with the header is not mangled — the pipeline’s round_trips gate makes that safe either way).