common

Documentation

Index

• Constants
• func Dedup(messageChan chan LogMessage) chan LogMessage
• func FlattenAttributes(m, into map[string]interface{}, prefix string)
• func MatchesQuery(m LogMessage, q Query) bool
• func MustJsonDecode(jsonString string, dst interface{})
• func MustJsonEncode(obj interface{}) string
• func Project(m map[string]interface{}, fields []string) map[string]interface{}
• func ReQueryFollow(ctx context.Context, queryMessagesFunc func() ([]LogMessage, error)) <-chan LogMessage
• type Client
• type EqualityFilter
  • func (f EqualityFilter) Matches(m LogMessage) bool
• type ExistenceFilter
  • func (f ExistenceFilter) Matches(m LogMessage) bool
• type LogMessage
  • func FlattenLogMessage(message LogMessage) LogMessage
  • func NewLogMessage() LogMessage
  • func (lm LogMessage) ContentHash() string
  • func (lm LogMessage) Map() map[string]interface{}
  • func (lm LogMessage) Message() (string, bool)
  • func (lm LogMessage) UniqueID() string
• type MembershipFilter
  • func (f MembershipFilter) Matches(m LogMessage) bool
• type Query
• type QuerySelectors

Constants

const (
	TimeFormat        = time.RFC3339
	FollowPollTime    = 5 * time.Second
	ConnectionRetries = 10
)

Functions

func Dedup

func Dedup(messageChan chan LogMessage) chan LogMessage

Skips duplicate messages (based on .ID)

func FlattenAttributes

func FlattenAttributes(m, into map[string]interface{}, prefix string)

func MatchesQuery

func MatchesQuery(m LogMessage, q Query) bool

func MustJsonDecode

func MustJsonDecode(jsonString string, dst interface{})

func MustJsonEncode

func MustJsonEncode(obj interface{}) string

func Project

func Project(m map[string]interface{}, fields []string) map[string]interface{}

func ReQueryFollow

func ReQueryFollow(ctx context.Context, queryMessagesFunc func() ([]LogMessage, error)) <-chan LogMessage

This is a simplistic way to implement log "following" (tailing) in a generic way. The idea is to simply execute the fetch log query (implemented by `queryMessagesFunc`) over and over, every `FollowPollTime` seconds, and push the results through the deduplicating result channel returned (deduplication happens based on message ID) This may seem overly inefficient, but due to the eventual-consistency type behavior of many log aggregation systems, logs may not actually arrive in sequence, so requesting new logs based on timestamps won't work reliably.

Types

type Client

type Client interface {
	Query(ctx context.Context, query Query) <-chan LogMessage
	ImplementsAdvancedFilters() bool
}

type EqualityFilter

type EqualityFilter struct {
	FieldName string
	Operator  string
	Value     string
}

func (EqualityFilter) Matches

func (f EqualityFilter) Matches(m LogMessage) bool

type ExistenceFilter

type ExistenceFilter struct {
	FieldName string
	Exists    bool // true if FieldName should exist in the message, false if FieldName should *not* exist

}

func (ExistenceFilter) Matches

func (f ExistenceFilter) Matches(m LogMessage) bool

Matches indicates whether the existence filter matches the log message

type LogMessage

type LogMessage struct {
	ID        string    `json:"id,omitempty"`
	Timestamp time.Time `json:"@timestamp"`
	// required: "message" attribute
	Attributes map[string]interface{} `json:"attributes"`
	MessageKey string                 `json:"-"`
}

func FlattenLogMessage

func FlattenLogMessage(message LogMessage) LogMessage

func NewLogMessage

func NewLogMessage() LogMessage

func (LogMessage) ContentHash

func (lm LogMessage) ContentHash() string

func (LogMessage) Map

func (lm LogMessage) Map() map[string]interface{}

Map performs a shallow copy of the Attributes map and adds fields for '@id' and '@timestamp'

func (LogMessage) Message

func (lm LogMessage) Message() (string, bool)

func (LogMessage) UniqueID

func (lm LogMessage) UniqueID() string

type MembershipFilter

type MembershipFilter struct {
	FieldName     string
	ValidValues   []string
	InvalidValues []string
}

func (MembershipFilter) Matches

func (f MembershipFilter) Matches(m LogMessage) bool

Matches indicates whether the log message satisfies membership constraints

type Query

type Query struct {
	QueryString       string
	After             *time.Time
	Before            *time.Time
	SelectFields      []string
	EqualityFilters   []EqualityFilter
	ExistenceFilters  []ExistenceFilter
	MembershipFilters []MembershipFilter
	MaxResults        int
	Unique            bool
	Follow            bool
}

type QuerySelectors

type QuerySelectors struct {
	Last        string   `yaml:"last,omitempty"`
	Before      string   `yaml:"before,omitempty"`
	After       string   `yaml:"after,omitempty"`
	Select      []string `yaml:"select,omitempty"`
	Where       []string `yaml:"where,omitempty"`
	OneOf       []string `yaml:"one_of,omitempty"`
	NotOneOf    []string `yaml:"not_one_of,omitempty"`
	Exists      []string `yaml:"exists,omitempty"`
	NotExists   []string `yaml:"not_exists,omitempty"`
	Unique      bool     `yaml:"unique,omitempty"`
	QueryString []string `yaml:"query,omitempty"`
	MessageKey  string   `yaml:"msg,omitempty"`
}