diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
index f076036..44349ca 100644
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1,9 +1,9 @@
# These are supported funding model platforms
-github: [n4vrl0s3] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+github: [sha-wrks]
patreon: # Replace with a single Patreon username
open_collective: # Replace with a single Open Collective username
-ko_fi: yanshaaa # Replace with a single Ko-fi username
+ko_fi: # Replace with a single Ko-fi username
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
liberapay: # Replace with a single Liberapay username
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..ececb2d
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,49 @@
+name: CI
+
+on:
+ push:
+ branches: [main]
+ pull_request:
+ branches: [main]
+
+env:
+ CARGO_TERM_COLOR: always
+
+jobs:
+ test:
+ name: Test
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Install Rust stable
+ uses: dtolnay/rust-toolchain@stable
+
+ - name: Cache dependencies
+ uses: Swatinem/rust-cache@v2
+
+ - name: Build
+ run: cargo build --verbose
+
+ - name: Run tests
+ run: cargo test --verbose
+
+ lint:
+ name: Lint
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Install Rust stable
+ uses: dtolnay/rust-toolchain@stable
+ with:
+ components: rustfmt, clippy
+
+ - name: Cache dependencies
+ uses: Swatinem/rust-cache@v2
+
+ - name: Check formatting
+ run: cargo fmt --check
+
+ - name: Clippy
+ run: cargo clippy -- -D warnings
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..fc122c0
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,36 @@
+# Rust build output
+/target/
+
+# Cargo lock file (keep for binaries, remove this line if publishing as a library)
+# Cargo.lock
+
+# Editor and IDE
+.vscode/settings.json
+.vscode/launch.json
+.vscode/tasks.json
+.idea/
+*.iml
+
+# OS generated
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V8
+.Trashes
+ehthumbs.db
+Thumbs.db
+desktop.ini
+
+# Environment and secrets
+.env
+.env.local
+.env.*.local
+*.pem
+*.key
+
+# Logs
+*.log
+!tests/fixtures/*.log
+
+# Benchmark results
+criterion/
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 2e19b90..ff493aa 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -60,8 +60,7 @@ representative at an online or offline event.
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported to the community leaders responsible for enforcement at
-n4vrl0s3@gmail.com.
-All complaints will be reviewed and investigated promptly and fairly.
+yansha@yansha.dev. All complaints will be reviewed and investigated promptly and fairly.
All community leaders are obligated to respect the privacy and security of the
reporter of any incident.
@@ -126,3 +125,4 @@ enforcement ladder](https://github.com/mozilla/diversity).
For answers to common questions about this code of conduct, see the FAQ at
https://www.contributor-covenant.org/faq. Translations are available at
https://www.contributor-covenant.org/translations.
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..2cb5b2d
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,53 @@
+# Contribution Guide
+
+Thank you for your interest in contributing to this project! Your contributions can help make this project better. Here are some guidelines to help you get started.
+
+## How to Contribute
+
+1. Fork this repository:
+ - Click the `Fork` button at the top of this repository page.
+2. Clone the forked repository to your local machine.
+ ```bash
+ git clone https://github.com/username/Log-Rift.git
+ ```
+ - Replace `username` with your GitHub username.
+3. Create a new branch
+ - Create a new branch for the feature or fix you want to add.
+ ```
+ cd Log-Rift
+ git checkout -b your-branch-name
+ ```
+ - Use a descriptive branch name that reflects the feature or fix you are working on.
+4. Make the necessary changes:
+ - Add or modify your code.
+5. Commit your changes:
+ - Make sure to write a clear and descriptive commit message.
+ ```
+ git add .
+ git commit -m "Brief description of the changes you made"
+ ```
+6. Push to your repository:
+ - Push your branch to your GitHub repository.
+ ```
+ git push origin your-branch-name
+ ```
+7. Create a Pull Request (PR):
+ - Go to the original repository page and create a pull request from your branch.
+ - Provide a clear description of what you added or fixed in your pull request.
+
+## Coding Guidelines
+
+- Follow a consistent coding standard: Ensure your code is consistent with the existing code style in this project.
+- Write clear documentation: Add necessary comments and documentation to help others understand your code.
+- Write tests: If possible, add tests for the features or fixes you are adding.
+
+## Reporting Issues
+
+If you find any bugs or have suggestions for improvements, please create a new issue on the Issues page.
+
+## Communication
+
+If you want to discuss something related to your contribution or the project in general, feel free to reach out to us via [Discussions](https://github.com/sha-wrks/Log-Rift/discussions).
+
+
+
+# Log-Rift
-This repository aims to provide a comprehensive starting point for understanding and implementing two fundamental search algorithms: Sequential Search and Binary Search. These search algorithms are implemented in Python and serve as a great introduction to search techniques for beginners and intermediate programmers.
+A fast, flexible command-line log analyzer written in Rust.
-
` | Minimum log level: trace, debug, info, warn, error, fatal |
+| `-s, --source ` | Filter by source name (substring match, case-insensitive) |
+| `-m, --message ` | Filter messages containing pattern (case-insensitive) |
+| `--from ` | Include entries on or after this datetime (RFC3339) |
+| `--to ` | Include entries on or before this datetime (RFC3339) |
+| `-o, --output ` | Output format: table (default), json, csv |
+| `--stats` | Print summary statistics instead of log entries |
+| `-h, --help` | Print help |
+| `-V, --version` | Print version |
-To set up the project locally, follow these steps:
+### Examples
-1. **Clone the repository:**
- ```bash
- git clone https://github.com/n4vrl0s3/Sequential-Search-and-Binary-Search.git
- ```
-2. **Navigate to the project directory:**
- ```bash
- cd Sequential-Search-and-Binary-Search
- ```
+Analyze a log file and show only errors:
-,
+ pub level_counts: HashMap,
+ pub source_counts: HashMap,
+ pub error_rate: f64,
+}
+
+pub fn aggregate(entries: Vec) -> AnalysisResult {
+ let count = entries.len();
+ let mut level_counts: HashMap = HashMap::new();
+ let mut source_counts: HashMap = HashMap::new();
+ let mut error_count: usize = 0;
+
+ for entry in &entries {
+ *level_counts.entry(entry.level.to_string()).or_insert(0) += 1;
+ *source_counts.entry(entry.source.clone()).or_insert(0) += 1;
+ if matches!(entry.level, LogLevel::Error | LogLevel::Fatal) {
+ error_count += 1;
+ }
+ }
+
+ let error_rate = if count > 0 {
+ error_count as f64 / count as f64 * 100.0
+ } else {
+ 0.0
+ };
+
+ AnalysisResult {
+ count,
+ entries,
+ level_counts,
+ source_counts,
+ error_rate,
+ }
+}
diff --git a/src/analyzer/mod.rs b/src/analyzer/mod.rs
new file mode 100644
index 0000000..9c1c785
--- /dev/null
+++ b/src/analyzer/mod.rs
@@ -0,0 +1,102 @@
+pub mod aggregator;
+pub use aggregator::AnalysisResult;
+
+use anyhow::Result;
+use chrono::{DateTime, Utc};
+use rayon::prelude::*;
+use std::fs;
+use std::path::Path;
+
+use crate::filter::Filter;
+use crate::{LogEntry, LogLevel};
+use crate::parser;
+
+pub struct LogAnalyzer {
+ entries: Vec,
+ filter: Filter,
+}
+
+impl LogAnalyzer {
+ pub fn load_files + Sync>(paths: &[P]) -> Result {
+ let entries: Vec = paths
+ .par_iter()
+ .flat_map(|path| {
+ let content = match fs::read_to_string(path.as_ref()) {
+ Ok(c) => c,
+ Err(_) => return Vec::new(),
+ };
+ content
+ .lines()
+ .filter(|l| !l.trim().is_empty())
+ .filter_map(|line| {
+ let line = line.trim_end_matches('\r');
+ let p = parser::auto_detect(line);
+ p.parse(line)
+ })
+ .collect::>()
+ })
+ .collect();
+
+ Ok(LogAnalyzer {
+ entries,
+ filter: Filter::default(),
+ })
+ }
+
+ pub fn load_stdin() -> Result {
+ use std::io::{self, BufRead};
+ let stdin = io::stdin();
+ let entries: Vec = stdin
+ .lock()
+ .lines()
+ .filter_map(|l| l.ok())
+ .filter(|l| !l.trim().is_empty())
+ .filter_map(|line| {
+ let line = line.trim_end_matches('\r').to_string();
+ let p = parser::auto_detect(&line);
+ p.parse(&line)
+ })
+ .collect();
+
+ Ok(LogAnalyzer {
+ entries,
+ filter: Filter::default(),
+ })
+ }
+
+ pub fn filter_by_level(mut self, level: LogLevel) -> Self {
+ self.filter.level = Some(level);
+ self
+ }
+
+ pub fn filter_by_source(mut self, source: impl Into) -> Self {
+ self.filter.source = Some(source.into());
+ self
+ }
+
+ pub fn filter_by_message(mut self, pattern: impl Into) -> Self {
+ self.filter.message_contains = Some(pattern.into());
+ self
+ }
+
+ pub fn filter_by_time_range(mut self, from: DateTime, to: DateTime) -> Self {
+ self.filter.from = Some(from);
+ self.filter.to = Some(to);
+ self
+ }
+
+ pub fn analyze(self) -> AnalysisResult {
+ let filter = self.filter;
+ let filtered: Vec = self
+ .entries
+ .into_iter()
+ .filter(|e| filter.matches(e))
+ .collect();
+
+ aggregator::aggregate(filtered)
+ }
+
+ pub fn entry_count(&self) -> usize {
+ self.entries.len()
+ }
+}
diff --git a/src/filter/engine.rs b/src/filter/engine.rs
new file mode 100644
index 0000000..f681659
--- /dev/null
+++ b/src/filter/engine.rs
@@ -0,0 +1,101 @@
+use chrono::{DateTime, Utc};
+
+use crate::{LogEntry, LogLevel};
+
+#[derive(Debug, Clone, Default)]
+pub struct Filter {
+ pub level: Option,
+ pub source: Option,
+ pub message_contains: Option,
+ pub from: Option>,
+ pub to: Option>,
+}
+
+impl Filter {
+ pub fn new() -> Self {
+ Self::default()
+ }
+
+ pub fn matches(&self, entry: &LogEntry) -> bool {
+ if let Some(ref min_level) = self.level {
+ if &entry.level < min_level {
+ return false;
+ }
+ }
+
+ if let Some(ref src) = self.source {
+ if !entry.source.to_lowercase().contains(&src.to_lowercase()) {
+ return false;
+ }
+ }
+
+ if let Some(ref pattern) = self.message_contains {
+ if !entry.message.to_lowercase().contains(&pattern.to_lowercase()) {
+ return false;
+ }
+ }
+
+ if let Some(from) = self.from {
+ match entry.timestamp {
+ Some(ts) if ts >= from => {}
+ _ => return false,
+ }
+ }
+
+ if let Some(to) = self.to {
+ match entry.timestamp {
+ Some(ts) if ts <= to => {}
+ _ => return false,
+ }
+ }
+
+ true
+ }
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use crate::LogLevel;
+ use std::collections::HashMap;
+
+ fn make_entry(level: LogLevel, source: &str, message: &str) -> LogEntry {
+ LogEntry {
+ timestamp: None,
+ level,
+ source: source.to_string(),
+ message: message.to_string(),
+ fields: HashMap::new(),
+ }
+ }
+
+ #[test]
+ fn test_level_filter() {
+ let mut f = Filter::new();
+ f.level = Some(LogLevel::Error);
+
+ assert!(!f.matches(&make_entry(LogLevel::Info, "app", "msg")));
+ assert!(!f.matches(&make_entry(LogLevel::Warn, "app", "msg")));
+ assert!(f.matches(&make_entry(LogLevel::Error, "app", "msg")));
+ assert!(f.matches(&make_entry(LogLevel::Fatal, "app", "msg")));
+ }
+
+ #[test]
+ fn test_source_filter() {
+ let mut f = Filter::new();
+ f.source = Some("database".to_string());
+
+ assert!(f.matches(&make_entry(LogLevel::Info, "database", "msg")));
+ assert!(f.matches(&make_entry(LogLevel::Info, "my-database-pool", "msg")));
+ assert!(!f.matches(&make_entry(LogLevel::Info, "webserver", "msg")));
+ }
+
+ #[test]
+ fn test_message_filter() {
+ let mut f = Filter::new();
+ f.message_contains = Some("timeout".to_string());
+
+ assert!(f.matches(&make_entry(LogLevel::Error, "app", "Connection Timeout exceeded")));
+ assert!(!f.matches(&make_entry(LogLevel::Error, "app", "Connection refused")));
+ }
+}
diff --git a/src/filter/mod.rs b/src/filter/mod.rs
new file mode 100644
index 0000000..e58dfd4
--- /dev/null
+++ b/src/filter/mod.rs
@@ -0,0 +1,2 @@
+pub mod engine;
+pub use engine::Filter;
diff --git a/src/lib.rs b/src/lib.rs
new file mode 100644
index 0000000..44694b2
--- /dev/null
+++ b/src/lib.rs
@@ -0,0 +1,60 @@
+pub mod analyzer;
+pub mod filter;
+pub mod output;
+pub mod parser;
+
+use chrono::{DateTime, Utc};
+use std::collections::HashMap;
+use std::fmt;
+use std::str::FromStr;
+
+pub use analyzer::LogAnalyzer;
+pub use parser::LogParser;
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize)]
+pub enum LogLevel {
+ Trace,
+ Debug,
+ Info,
+ Warn,
+ Error,
+ Fatal,
+}
+
+impl FromStr for LogLevel {
+ type Err = anyhow::Error;
+
+ fn from_str(s: &str) -> Result {
+ match s.to_uppercase().as_str() {
+ "TRACE" | "TRC" => Ok(LogLevel::Trace),
+ "DEBUG" | "DBG" => Ok(LogLevel::Debug),
+ "INFO" | "INF" => Ok(LogLevel::Info),
+ "WARN" | "WARNING" | "WRN" => Ok(LogLevel::Warn),
+ "ERROR" | "ERR" => Ok(LogLevel::Error),
+ "FATAL" | "CRITICAL" | "CRIT" => Ok(LogLevel::Fatal),
+ _ => Err(anyhow::anyhow!("Unknown log level: {}", s)),
+ }
+ }
+}
+
+impl fmt::Display for LogLevel {
+ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+ match self {
+ LogLevel::Trace => write!(f, "TRACE"),
+ LogLevel::Debug => write!(f, "DEBUG"),
+ LogLevel::Info => write!(f, "INFO"),
+ LogLevel::Warn => write!(f, "WARN"),
+ LogLevel::Error => write!(f, "ERROR"),
+ LogLevel::Fatal => write!(f, "FATAL"),
+ }
+ }
+}
+
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct LogEntry {
+ pub timestamp: Option>,
+ pub level: LogLevel,
+ pub source: String,
+ pub message: String,
+ pub fields: HashMap,
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 0000000..4daa13c
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,113 @@
+use anyhow::Result;
+use clap::Parser;
+use std::path::PathBuf;
+use std::str::FromStr;
+
+use logagg::analyzer::LogAnalyzer;
+use logagg::output::{self, OutputFormat};
+use logagg::LogLevel;
+
+#[derive(Parser)]
+#[command(
+ name = "logagg",
+ about = "A fast, flexible command-line log analyzer",
+ version
+)]
+struct Cli {
+ /// Log files to analyze (reads from stdin if omitted)
+ files: Vec,
+
+ /// Filter by minimum log level
+ #[arg(short, long, value_name = "LEVEL")]
+ level: Option,
+
+ /// Filter by source (substring match)
+ #[arg(short, long, value_name = "SOURCE")]
+ source: Option,
+
+ /// Filter messages containing pattern (case-insensitive)
+ #[arg(short = 'm', long, value_name = "PATTERN")]
+ message: Option,
+
+ /// Include entries from this datetime (RFC3339, e.g. 2024-01-15T09:00:00Z)
+ #[arg(long, value_name = "DATETIME")]
+ from: Option,
+
+ /// Include entries up to this datetime (RFC3339)
+ #[arg(long, value_name = "DATETIME")]
+ to: Option,
+
+ /// Output format
+ #[arg(short, long, value_name = "FORMAT", default_value = "table")]
+ output: String,
+
+ /// Show summary statistics instead of log entries
+ #[arg(long)]
+ stats: bool,
+}
+
+fn main() -> Result<()> {
+ let cli = Cli::parse();
+
+ // Load entries
+ let analyzer = if cli.files.is_empty() {
+ LogAnalyzer::load_stdin()?
+ } else {
+ LogAnalyzer::load_files(&cli.files)?
+ };
+
+ // Apply filters (builder pattern)
+ let mut analyzer = analyzer;
+
+ if let Some(ref level_str) = cli.level {
+ let level = LogLevel::from_str(level_str)
+ .map_err(|_| anyhow::anyhow!("Invalid level: {}. Use trace/debug/info/warn/error/fatal", level_str))?;
+ analyzer = analyzer.filter_by_level(level);
+ }
+
+ if let Some(ref src) = cli.source {
+ analyzer = analyzer.filter_by_source(src.clone());
+ }
+
+ if let Some(ref pattern) = cli.message {
+ analyzer = analyzer.filter_by_message(pattern.clone());
+ }
+
+ if cli.from.is_some() || cli.to.is_some() {
+ use chrono::{DateTime, Utc};
+ let from = cli
+ .from
+ .as_deref()
+ .map(|s| {
+ s.parse::>()
+ .map_err(|_| anyhow::anyhow!("Invalid --from datetime: {}", s))
+ })
+ .transpose()?
+ .unwrap_or(DateTime::::MIN_UTC);
+
+ let to = cli
+ .to
+ .as_deref()
+ .map(|s| {
+ s.parse::>()
+ .map_err(|_| anyhow::anyhow!("Invalid --to datetime: {}", s))
+ })
+ .transpose()?
+ .unwrap_or(DateTime::::MAX_UTC);
+
+ analyzer = analyzer.filter_by_time_range(from, to);
+ }
+
+ let result = analyzer.analyze();
+
+ // Render output
+ let fmt = OutputFormat::from_str(&cli.output)?;
+
+ if cli.stats {
+ print!("{}", logagg::output::table::render_stats(&result)?);
+ } else {
+ print!("{}", output::render(&result, fmt)?);
+ }
+
+ Ok(())
+}
diff --git a/src/output/csv.rs b/src/output/csv.rs
new file mode 100644
index 0000000..9948e4b
--- /dev/null
+++ b/src/output/csv.rs
@@ -0,0 +1,23 @@
+use anyhow::Result;
+
+use crate::analyzer::AnalysisResult;
+
+pub fn render(result: &AnalysisResult) -> Result {
+ let mut out = String::from("timestamp,level,source,message\n");
+
+ for entry in &result.entries {
+ let ts = entry
+ .timestamp
+ .map(|t| t.to_rfc3339())
+ .unwrap_or_default();
+
+ let msg = entry.message.replace('"', "\"\"");
+
+ out.push_str(&format!(
+ "{},{},{},\"{}\"\n",
+ ts, entry.level, entry.source, msg
+ ));
+ }
+
+ Ok(out)
+}
diff --git a/src/output/json.rs b/src/output/json.rs
new file mode 100644
index 0000000..150dd8c
--- /dev/null
+++ b/src/output/json.rs
@@ -0,0 +1,7 @@
+use anyhow::Result;
+
+use crate::analyzer::AnalysisResult;
+
+pub fn render(result: &AnalysisResult) -> Result {
+ Ok(serde_json::to_string_pretty(result)?)
+}
diff --git a/src/output/mod.rs b/src/output/mod.rs
new file mode 100644
index 0000000..c5a40e5
--- /dev/null
+++ b/src/output/mod.rs
@@ -0,0 +1,34 @@
+pub mod csv;
+pub mod json;
+pub mod table;
+
+use anyhow::Result;
+
+use crate::analyzer::AnalysisResult;
+
+pub enum OutputFormat {
+ Table,
+ Json,
+ Csv,
+}
+
+impl std::str::FromStr for OutputFormat {
+ type Err = anyhow::Error;
+
+ fn from_str(s: &str) -> Result {
+ match s.to_lowercase().as_str() {
+ "table" => Ok(OutputFormat::Table),
+ "json" => Ok(OutputFormat::Json),
+ "csv" => Ok(OutputFormat::Csv),
+ _ => Err(anyhow::anyhow!("Unknown format: {}. Use table, json, or csv.", s)),
+ }
+ }
+}
+
+pub fn render(result: &AnalysisResult, format: OutputFormat) -> Result {
+ match format {
+ OutputFormat::Table => table::render(result),
+ OutputFormat::Json => json::render(result),
+ OutputFormat::Csv => csv::render(result),
+ }
+}
diff --git a/src/output/table.rs b/src/output/table.rs
new file mode 100644
index 0000000..c37871f
--- /dev/null
+++ b/src/output/table.rs
@@ -0,0 +1,60 @@
+use anyhow::Result;
+use prettytable::{Cell, Row, Table};
+
+use crate::analyzer::AnalysisResult;
+
+pub fn render(result: &AnalysisResult) -> Result {
+ let mut table = Table::new();
+
+ table.add_row(Row::new(vec![
+ Cell::new("Timestamp"),
+ Cell::new("Level"),
+ Cell::new("Source"),
+ Cell::new("Message"),
+ ]));
+
+ for entry in &result.entries {
+ let ts = entry
+ .timestamp
+ .map(|t| t.format("%Y-%m-%d %H:%M:%S").to_string())
+ .unwrap_or_else(|| "-".to_string());
+
+ let msg = if entry.message.len() > 80 {
+ format!("{}…", &entry.message[..79])
+ } else {
+ entry.message.clone()
+ };
+
+ table.add_row(Row::new(vec![
+ Cell::new(&ts),
+ Cell::new(&entry.level.to_string()),
+ Cell::new(&entry.source),
+ Cell::new(&msg),
+ ]));
+ }
+
+ Ok(format!("{table}"))
+}
+
+pub fn render_stats(result: &AnalysisResult) -> Result {
+ let mut output = String::new();
+
+ output.push_str(&format!("Total entries : {}\n", result.count));
+ output.push_str(&format!("Error rate : {:.1}%\n\n", result.error_rate));
+
+ output.push_str("By level:\n");
+ let mut levels: Vec<_> = result.level_counts.iter().collect();
+ levels.sort_by(|a, b| b.1.cmp(a.1));
+ for (level, count) in &levels {
+ output.push_str(&format!(" {:8} {}\n", level, count));
+ }
+
+ output.push_str("\nBy source (top 10):\n");
+ let mut sources: Vec<_> = result.source_counts.iter().collect();
+ sources.sort_by(|a, b| b.1.cmp(a.1));
+ for (src, count) in sources.iter().take(10) {
+ output.push_str(&format!(" {:30} {}\n", src, count));
+ }
+
+ Ok(output)
+}
diff --git a/src/parser/json.rs b/src/parser/json.rs
new file mode 100644
index 0000000..475f582
--- /dev/null
+++ b/src/parser/json.rs
@@ -0,0 +1,101 @@
+use chrono::{DateTime, Utc};
+use std::str::FromStr;
+
+use crate::{LogEntry, LogLevel};
+use super::LogParser;
+
+pub struct JsonLogParser;
+
+impl LogParser for JsonLogParser {
+ fn parse(&self, line: &str) -> Option {
+ let json: serde_json::Value = serde_json::from_str(line).ok()?;
+
+ Some(LogEntry {
+ timestamp: json
+ .get("timestamp")
+ .and_then(|v| v.as_str())
+ .and_then(|s| DateTime::parse_from_rfc3339(s).ok())
+ .map(|dt| dt.with_timezone(&Utc)),
+ level: json
+ .get("level")
+ .and_then(|v| v.as_str())
+ .and_then(|s| LogLevel::from_str(s).ok())
+ .unwrap_or(LogLevel::Info),
+ source: json
+ .get("source")
+ .and_then(|v| v.as_str())
+ .unwrap_or("unknown")
+ .to_string(),
+ message: json
+ .get("message")
+ .or_else(|| json.get("msg"))
+ .and_then(|v| v.as_str())
+ .unwrap_or("")
+ .to_string(),
+ fields: json
+ .as_object()
+ .map(|obj| {
+ obj.iter()
+ .filter(|(k, _)| {
+ !["timestamp", "level", "source", "message", "msg"]
+ .contains(&k.as_str())
+ })
+ .map(|(k, v)| (k.clone(), v.to_string()))
+ .collect()
+ })
+ .unwrap_or_default(),
+ })
+ }
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn test_parse_valid_json_log() {
+ let parser = JsonLogParser;
+ let line = r#"{"timestamp":"2024-01-15T12:00:00Z","level":"ERROR","source":"app","message":"Connection failed"}"#;
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert_eq!(entry.level, LogLevel::Error);
+ assert_eq!(entry.message, "Connection failed");
+ assert_eq!(entry.source, "app");
+ }
+
+ #[test]
+ fn test_parse_invalid_json() {
+ let parser = JsonLogParser;
+ assert!(parser.parse("not json").is_none());
+ }
+
+ #[test]
+ fn test_parse_missing_fields() {
+ let parser = JsonLogParser;
+ let line = r#"{"level":"WARN"}"#;
+
+ let entry = parser.parse(line).expect("Should parse with defaults");
+ assert_eq!(entry.message, "");
+ assert_eq!(entry.source, "unknown");
+ assert_eq!(entry.level, LogLevel::Warn);
+ }
+
+ #[test]
+ fn test_parse_msg_alias() {
+ let parser = JsonLogParser;
+ let line = r#"{"level":"INFO","msg":"hello world"}"#;
+
+ let entry = parser.parse(line).expect("Should parse msg alias");
+ assert_eq!(entry.message, "hello world");
+ }
+
+ #[test]
+ fn test_extra_fields_captured() {
+ let parser = JsonLogParser;
+ let line = r#"{"level":"INFO","message":"test","request_id":"abc123","latency_ms":42}"#;
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert!(entry.fields.contains_key("request_id"));
+ assert!(entry.fields.contains_key("latency_ms"));
+ }
+}
diff --git a/src/parser/mod.rs b/src/parser/mod.rs
new file mode 100644
index 0000000..73adea8
--- /dev/null
+++ b/src/parser/mod.rs
@@ -0,0 +1,24 @@
+pub mod json;
+pub mod regex;
+pub mod structured;
+
+pub use json::JsonLogParser;
+pub use regex::RegexLogParser;
+pub use structured::StructuredLogParser;
+
+use crate::LogEntry;
+
+pub trait LogParser: Send + Sync {
+ fn parse(&self, line: &str) -> Option;
+}
+
+pub fn auto_detect(line: &str) -> Box {
+ let trimmed = line.trim();
+ if trimmed.starts_with('{') {
+ Box::new(JsonLogParser)
+ } else if trimmed.contains('=') && !trimmed.contains('[') && !trimmed.starts_with('#') {
+ Box::new(StructuredLogParser)
+ } else {
+ Box::new(RegexLogParser::default())
+ }
+}
diff --git a/src/parser/regex.rs b/src/parser/regex.rs
new file mode 100644
index 0000000..4f8ff9f
--- /dev/null
+++ b/src/parser/regex.rs
@@ -0,0 +1,177 @@
+use chrono::{DateTime, NaiveDateTime, TimeZone, Utc};
+use regex::Regex;
+use std::str::FromStr;
+
+use crate::{LogEntry, LogLevel};
+use super::LogParser;
+
+pub struct RegexLogParser {
+ // 2024-01-15T12:00:00Z ERROR [source] message
+ // 2024-01-15 12:00:00.000 ERROR source: message
+ iso_re: Regex,
+ // [2024-01-15 12:00:00] [ERROR] message
+ bracketed_re: Regex,
+ // Jan 15 12:00:00 host process[pid]: message
+ syslog_re: Regex,
+ // ERROR: message or ERROR message
+ simple_re: Regex,
+}
+
+impl Default for RegexLogParser {
+ fn default() -> Self {
+ Self {
+ iso_re: Regex::new(
+ r"(?i)^(\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[.,]\d+)?(?:Z|[+-]\d{2}:?\d{2})?)\s+(TRACE|DEBUG|INFO|WARN(?:ING)?|ERROR|ERR|FATAL|CRITICAL)\s*(?:\[([^\]]+)\])?\s*(.*)$"
+ ).unwrap(),
+ bracketed_re: Regex::new(
+ r"(?i)^\[(\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}[^\]]*)\]\s+\[?(TRACE|DEBUG|INFO|WARN(?:ING)?|ERROR|FATAL)\]?\s+(.*)$"
+ ).unwrap(),
+ syslog_re: Regex::new(
+ r"^(\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2})\s+\S+\s+([^\[:\s]+)(?:\[\d+\])?:\s+(.+)$"
+ ).unwrap(),
+ simple_re: Regex::new(
+ r"(?i)^(TRACE|DEBUG|INFO|WARN(?:ING)?|ERROR|ERR|FATAL|CRITICAL)\s*[:\-]?\s+(.+)$"
+ ).unwrap(),
+ }
+ }
+}
+
+impl LogParser for RegexLogParser {
+ fn parse(&self, line: &str) -> Option {
+ let line = line.trim();
+
+ if let Some(caps) = self.iso_re.captures(line) {
+ let ts_str = caps.get(1).map(|m| m.as_str()).unwrap_or("");
+ let level_str = caps.get(2).map(|m| m.as_str()).unwrap_or("INFO");
+ let source = caps.get(3).map(|m| m.as_str()).unwrap_or("unknown").to_string();
+ let message = caps.get(4).map(|m| m.as_str()).unwrap_or("").to_string();
+
+ return Some(LogEntry {
+ timestamp: parse_timestamp(ts_str),
+ level: LogLevel::from_str(level_str).unwrap_or(LogLevel::Info),
+ source,
+ message,
+ fields: Default::default(),
+ });
+ }
+
+ if let Some(caps) = self.bracketed_re.captures(line) {
+ let ts_str = caps.get(1).map(|m| m.as_str()).unwrap_or("");
+ let level_str = caps.get(2).map(|m| m.as_str()).unwrap_or("INFO");
+ let message = caps.get(3).map(|m| m.as_str()).unwrap_or("").to_string();
+
+ return Some(LogEntry {
+ timestamp: parse_timestamp(ts_str),
+ level: LogLevel::from_str(level_str).unwrap_or(LogLevel::Info),
+ source: "unknown".to_string(),
+ message,
+ fields: Default::default(),
+ });
+ }
+
+ if let Some(caps) = self.syslog_re.captures(line) {
+ let source = caps.get(2).map(|m| m.as_str()).unwrap_or("unknown").to_string();
+ let message = caps.get(3).map(|m| m.as_str()).unwrap_or("").to_string();
+
+ return Some(LogEntry {
+ timestamp: None,
+ level: LogLevel::Info,
+ source,
+ message,
+ fields: Default::default(),
+ });
+ }
+
+ if let Some(caps) = self.simple_re.captures(line) {
+ let level_str = caps.get(1).map(|m| m.as_str()).unwrap_or("INFO");
+ let message = caps.get(2).map(|m| m.as_str()).unwrap_or("").to_string();
+
+ return Some(LogEntry {
+ timestamp: None,
+ level: LogLevel::from_str(level_str).unwrap_or(LogLevel::Info),
+ source: "unknown".to_string(),
+ message,
+ fields: Default::default(),
+ });
+ }
+
+ // Fallback: treat entire line as an INFO message
+ if !line.is_empty() {
+ return Some(LogEntry {
+ timestamp: None,
+ level: LogLevel::Info,
+ source: "unknown".to_string(),
+ message: line.to_string(),
+ fields: Default::default(),
+ });
+ }
+
+ None
+ }
+}
+
+fn parse_timestamp(s: &str) -> Option> {
+ // Try RFC3339 / ISO 8601 with timezone
+ if let Ok(dt) = DateTime::parse_from_rfc3339(s) {
+ return Some(dt.with_timezone(&Utc));
+ }
+ // Try without timezone suffix (assume UTC)
+ let formats = [
+ "%Y-%m-%dT%H:%M:%S%.f",
+ "%Y-%m-%dT%H:%M:%S",
+ "%Y-%m-%d %H:%M:%S%.f",
+ "%Y-%m-%d %H:%M:%S",
+ ];
+ for fmt in &formats {
+ if let Ok(ndt) = NaiveDateTime::parse_from_str(s, fmt) {
+ return Some(Utc.from_utc_datetime(&ndt));
+ }
+ }
+ None
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn test_parse_iso_format() {
+ let parser = RegexLogParser::default();
+ let line = "2024-01-15T12:00:00Z ERROR [myapp] Connection timeout";
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert_eq!(entry.level, LogLevel::Error);
+ assert_eq!(entry.source, "myapp");
+ assert_eq!(entry.message, "Connection timeout");
+ assert!(entry.timestamp.is_some());
+ }
+
+ #[test]
+ fn test_parse_space_separated_timestamp() {
+ let parser = RegexLogParser::default();
+ let line = "2024-01-15 12:00:00.000 WARN Service degraded";
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert_eq!(entry.level, LogLevel::Warn);
+ }
+
+ #[test]
+ fn test_parse_simple_level_prefix() {
+ let parser = RegexLogParser::default();
+ let line = "ERROR: disk full";
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert_eq!(entry.level, LogLevel::Error);
+ assert_eq!(entry.message, "disk full");
+ }
+
+ #[test]
+ fn test_parse_bracketed_format() {
+ let parser = RegexLogParser::default();
+ let line = "[2024-01-15 12:00:00] [FATAL] system crash";
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert_eq!(entry.level, LogLevel::Fatal);
+ assert_eq!(entry.message, "system crash");
+ }
+}
diff --git a/src/parser/structured.rs b/src/parser/structured.rs
new file mode 100644
index 0000000..89e29bb
--- /dev/null
+++ b/src/parser/structured.rs
@@ -0,0 +1,163 @@
+use chrono::{DateTime, Utc};
+use std::collections::HashMap;
+use std::str::FromStr;
+
+use crate::{LogEntry, LogLevel};
+use super::LogParser;
+
+/// Parses logfmt / key=value structured log lines.
+/// Example: ts=2024-01-15T12:00:00Z level=error source=app msg="Connection failed" latency=100ms
+pub struct StructuredLogParser;
+
+impl LogParser for StructuredLogParser {
+ fn parse(&self, line: &str) -> Option {
+ let pairs = parse_kv(line.trim());
+ if pairs.is_empty() {
+ return None;
+ }
+
+ let get = |key: &str| pairs.get(key).map(|s| s.as_str());
+
+ let timestamp = get("ts")
+ .or_else(|| get("timestamp"))
+ .or_else(|| get("time"))
+ .and_then(|s| DateTime::parse_from_rfc3339(s).ok())
+ .map(|dt| dt.with_timezone(&Utc));
+
+ let level = get("level")
+ .or_else(|| get("lvl"))
+ .or_else(|| get("severity"))
+ .and_then(|s| LogLevel::from_str(s).ok())
+ .unwrap_or(LogLevel::Info);
+
+ let source = get("source")
+ .or_else(|| get("service"))
+ .or_else(|| get("app"))
+ .or_else(|| get("logger"))
+ .unwrap_or("unknown")
+ .to_string();
+
+ let message = get("msg")
+ .or_else(|| get("message"))
+ .or_else(|| get("text"))
+ .unwrap_or("")
+ .to_string();
+
+ let reserved = ["ts", "timestamp", "time", "level", "lvl", "severity",
+ "source", "service", "app", "logger", "msg", "message", "text"];
+
+ let fields: HashMap = pairs
+ .into_iter()
+ .filter(|(k, _)| !reserved.contains(&k.as_str()))
+ .collect();
+
+ Some(LogEntry { timestamp, level, source, message, fields })
+ }
+}
+
+fn parse_kv(line: &str) -> HashMap {
+ let mut map = HashMap::new();
+ let b = line.as_bytes();
+ let len = b.len();
+ let mut i = 0;
+
+ while i < len {
+ // Skip whitespace
+ while i < len && b[i].is_ascii_whitespace() {
+ i += 1;
+ }
+ if i >= len {
+ break;
+ }
+
+ // Read key (up to '=' or whitespace)
+ let key_start = i;
+ while i < len && b[i] != b'=' && !b[i].is_ascii_whitespace() {
+ i += 1;
+ }
+ let key = &line[key_start..i];
+ if key.is_empty() || i >= len || b[i] != b'=' {
+ // Token without '=', skip it
+ while i < len && !b[i].is_ascii_whitespace() {
+ i += 1;
+ }
+ continue;
+ }
+ i += 1; // consume '='
+
+ // Read value (quoted or unquoted)
+ let value = if i < len && b[i] == b'"' {
+ i += 1; // consume opening '"'
+ let mut val = String::new();
+ while i < len {
+ if b[i] == b'\\' && i + 1 < len {
+ i += 1;
+ val.push(b[i] as char);
+ i += 1;
+ } else if b[i] == b'"' {
+ i += 1; // consume closing '"'
+ break;
+ } else {
+ val.push(b[i] as char);
+ i += 1;
+ }
+ }
+ val
+ } else {
+ let val_start = i;
+ while i < len && !b[i].is_ascii_whitespace() {
+ i += 1;
+ }
+ line[val_start..i].to_string()
+ };
+
+ map.insert(key.to_string(), value);
+ }
+
+ map
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn test_parse_basic_kv() {
+ let parser = StructuredLogParser;
+ let line = r#"ts=2024-01-15T12:00:00Z level=error source=app msg="Connection failed""#;
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert_eq!(entry.level, LogLevel::Error);
+ assert_eq!(entry.source, "app");
+ assert_eq!(entry.message, "Connection failed");
+ assert!(entry.timestamp.is_some());
+ }
+
+ #[test]
+ fn test_parse_logfmt_aliases() {
+ let parser = StructuredLogParser;
+ let line = r#"time=2024-01-15T12:00:00Z lvl=warn service=api text="high latency""#;
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert_eq!(entry.level, LogLevel::Warn);
+ assert_eq!(entry.source, "api");
+ assert_eq!(entry.message, "high latency");
+ }
+
+ #[test]
+ fn test_extra_fields_in_fields_map() {
+ let parser = StructuredLogParser;
+ let line = r#"level=info msg=ok request_id=abc123 duration=42ms"#;
+
+ let entry = parser.parse(line).expect("Should parse");
+ assert!(entry.fields.contains_key("request_id"));
+ assert!(entry.fields.contains_key("duration"));
+ }
+
+ #[test]
+ fn test_parse_empty_line() {
+ let parser = StructuredLogParser;
+ assert!(parser.parse("").is_none());
+ assert!(parser.parse(" ").is_none());
+ }
+}
diff --git a/tests/fixtures/json.log b/tests/fixtures/json.log
new file mode 100644
index 0000000..b185cf1
--- /dev/null
+++ b/tests/fixtures/json.log
@@ -0,0 +1,11 @@
+{"timestamp":"2024-01-15T08:00:00Z","level":"INFO","source":"startup","message":"Application starting","version":"1.4.2"}
+{"timestamp":"2024-01-15T08:00:01Z","level":"INFO","source":"config","message":"Configuration loaded","env":"production"}
+{"timestamp":"2024-01-15T08:00:02Z","level":"DEBUG","source":"database","message":"Establishing connection pool","pool_size":10}
+{"timestamp":"2024-01-15T09:15:22Z","level":"INFO","source":"webserver","message":"Request handled","method":"GET","path":"/api/users","status":200,"latency_ms":45}
+{"timestamp":"2024-01-15T09:30:01Z","level":"WARN","source":"database","message":"Slow query detected","query_time_ms":2300,"table":"users"}
+{"timestamp":"2024-01-15T10:00:00Z","level":"ERROR","source":"database","message":"Connection pool exhausted","active":10,"waiting":5}
+{"timestamp":"2024-01-15T10:00:01Z","level":"ERROR","source":"webserver","message":"Request failed","method":"GET","path":"/api/data","status":503}
+{"timestamp":"2024-01-15T10:00:07Z","level":"INFO","source":"database","message":"Connection restored","downtime_ms":7000}
+{"timestamp":"2024-01-15T12:00:00Z","level":"INFO","source":"health","message":"Health check passed","checks":{"db":"ok","cache":"ok"}}
+{"timestamp":"2024-01-15T14:30:20Z","level":"ERROR","source":"memory","message":"Memory critical","usage_pct":95}
+{"timestamp":"2024-01-15T14:30:21Z","level":"FATAL","source":"runtime","message":"Out of memory - process terminating"}
diff --git a/tests/fixtures/large_file.log b/tests/fixtures/large_file.log
new file mode 100644
index 0000000..8cacfee
--- /dev/null
+++ b/tests/fixtures/large_file.log
@@ -0,0 +1,200 @@
+{"timestamp": "2024-01-15T00:00:00Z", "level": "INFO", "source": "cache", "message": "Unexpected state", "req_id": "req-0000"}
+{"timestamp": "2024-01-15T00:03:00Z", "level": "TRACE", "source": "webserver", "message": "Cache hit", "req_id": "req-0001"}
+{"timestamp": "2024-01-15T00:06:00Z", "level": "INFO", "source": "database", "message": "Connection timeout", "req_id": "req-0002"}
+{"timestamp": "2024-01-15T00:09:00Z", "level": "TRACE", "source": "database", "message": "Job started", "req_id": "req-0003"}
+{"timestamp": "2024-01-15T00:12:00Z", "level": "INFO", "source": "scheduler", "message": "Disk I/O error", "req_id": "req-0004"}
+{"timestamp": "2024-01-15T00:15:00Z", "level": "DEBUG", "source": "auth", "message": "Cache miss", "req_id": "req-0005"}
+{"timestamp": "2024-01-15T00:18:00Z", "level": "INFO", "source": "scheduler", "message": "Slow query", "req_id": "req-0006"}
+{"timestamp": "2024-01-15T00:21:00Z", "level": "INFO", "source": "webserver", "message": "Cache hit", "req_id": "req-0007"}
+{"timestamp": "2024-01-15T00:24:00Z", "level": "ERROR", "source": "scheduler", "message": "Cache hit", "req_id": "req-0008"}
+{"timestamp": "2024-01-15T00:27:00Z", "level": "INFO", "source": "scheduler", "message": "Request received", "req_id": "req-0009"}
+{"timestamp": "2024-01-15T00:30:00Z", "level": "FATAL", "source": "cache", "message": "Email queued", "req_id": "req-0010"}
+{"timestamp": "2024-01-15T00:33:00Z", "level": "INFO", "source": "cache", "message": "Cache hit", "req_id": "req-0011"}
+{"timestamp": "2024-01-15T00:36:00Z", "level": "INFO", "source": "scheduler", "message": "Query executed", "req_id": "req-0012"}
+{"timestamp": "2024-01-15T00:39:00Z", "level": "INFO", "source": "webserver", "message": "Query executed", "req_id": "req-0013"}
+{"timestamp": "2024-01-15T00:42:00Z", "level": "FATAL", "source": "webserver", "message": "Cache hit", "req_id": "req-0014"}
+{"timestamp": "2024-01-15T00:45:00Z", "level": "FATAL", "source": "scheduler", "message": "Cache hit", "req_id": "req-0015"}
+{"timestamp": "2024-01-15T00:48:00Z", "level": "TRACE", "source": "cache", "message": "Slow query", "req_id": "req-0016"}
+{"timestamp": "2024-01-15T00:51:00Z", "level": "TRACE", "source": "database", "message": "Disk I/O error", "req_id": "req-0017"}
+{"timestamp": "2024-01-15T00:54:00Z", "level": "TRACE", "source": "scheduler", "message": "Slow query", "req_id": "req-0018"}
+{"timestamp": "2024-01-15T00:57:00Z", "level": "DEBUG", "source": "webserver", "message": "Connection timeout", "req_id": "req-0019"}
+{"timestamp": "2024-01-15T01:00:00Z", "level": "INFO", "source": "auth", "message": "Unexpected state", "req_id": "req-0020"}
+{"timestamp": "2024-01-15T01:03:00Z", "level": "DEBUG", "source": "cache", "message": "Disk I/O error", "req_id": "req-0021"}
+{"timestamp": "2024-01-15T01:06:00Z", "level": "DEBUG", "source": "scheduler", "message": "Request received", "req_id": "req-0022"}
+{"timestamp": "2024-01-15T01:09:00Z", "level": "TRACE", "source": "cache", "message": "Request received", "req_id": "req-0023"}
+{"timestamp": "2024-01-15T01:12:00Z", "level": "ERROR", "source": "database", "message": "Job started", "req_id": "req-0024"}
+{"timestamp": "2024-01-15T01:15:00Z", "level": "INFO", "source": "auth", "message": "Disk I/O error", "req_id": "req-0025"}
+{"timestamp": "2024-01-15T01:18:00Z", "level": "INFO", "source": "webserver", "message": "Disk I/O error", "req_id": "req-0026"}
+{"timestamp": "2024-01-15T01:21:00Z", "level": "FATAL", "source": "mailer", "message": "Unexpected state", "req_id": "req-0027"}
+{"timestamp": "2024-01-15T01:24:00Z", "level": "INFO", "source": "webserver", "message": "Query executed", "req_id": "req-0028"}
+{"timestamp": "2024-01-15T01:27:00Z", "level": "INFO", "source": "auth", "message": "Unexpected state", "req_id": "req-0029"}
+{"timestamp": "2024-01-15T01:30:00Z", "level": "INFO", "source": "cache", "message": "Slow query", "req_id": "req-0030"}
+{"timestamp": "2024-01-15T01:33:00Z", "level": "WARN", "source": "database", "message": "Query executed", "req_id": "req-0031"}
+{"timestamp": "2024-01-15T01:36:00Z", "level": "INFO", "source": "auth", "message": "Connection timeout", "req_id": "req-0032"}
+{"timestamp": "2024-01-15T01:39:00Z", "level": "TRACE", "source": "webserver", "message": "Job started", "req_id": "req-0033"}
+{"timestamp": "2024-01-15T01:42:00Z", "level": "FATAL", "source": "auth", "message": "Cache miss", "req_id": "req-0034"}
+{"timestamp": "2024-01-15T01:45:00Z", "level": "INFO", "source": "webserver", "message": "Email queued", "req_id": "req-0035"}
+{"timestamp": "2024-01-15T01:48:00Z", "level": "WARN", "source": "database", "message": "Cache miss", "req_id": "req-0036"}
+{"timestamp": "2024-01-15T01:51:00Z", "level": "TRACE", "source": "database", "message": "Request received", "req_id": "req-0037"}
+{"timestamp": "2024-01-15T01:54:00Z", "level": "ERROR", "source": "mailer", "message": "Connection timeout", "req_id": "req-0038"}
+{"timestamp": "2024-01-15T01:57:00Z", "level": "FATAL", "source": "mailer", "message": "Job started", "req_id": "req-0039"}
+{"timestamp": "2024-01-15T02:00:00Z", "level": "DEBUG", "source": "mailer", "message": "Email queued", "req_id": "req-0040"}
+{"timestamp": "2024-01-15T02:03:00Z", "level": "DEBUG", "source": "scheduler", "message": "Cache hit", "req_id": "req-0041"}
+{"timestamp": "2024-01-15T02:06:00Z", "level": "TRACE", "source": "cache", "message": "Query executed", "req_id": "req-0042"}
+{"timestamp": "2024-01-15T02:09:00Z", "level": "WARN", "source": "mailer", "message": "Disk I/O error", "req_id": "req-0043"}
+{"timestamp": "2024-01-15T02:12:00Z", "level": "WARN", "source": "database", "message": "Job started", "req_id": "req-0044"}
+{"timestamp": "2024-01-15T02:15:00Z", "level": "ERROR", "source": "auth", "message": "Cache miss", "req_id": "req-0045"}
+{"timestamp": "2024-01-15T02:18:00Z", "level": "INFO", "source": "database", "message": "Email queued", "req_id": "req-0046"}
+{"timestamp": "2024-01-15T02:21:00Z", "level": "INFO", "source": "scheduler", "message": "Email queued", "req_id": "req-0047"}
+{"timestamp": "2024-01-15T02:24:00Z", "level": "INFO", "source": "auth", "message": "Cache miss", "req_id": "req-0048"}
+{"timestamp": "2024-01-15T02:27:00Z", "level": "TRACE", "source": "database", "message": "Slow query", "req_id": "req-0049"}
+{"timestamp": "2024-01-15T02:30:00Z", "level": "INFO", "source": "webserver", "message": "Disk I/O error", "req_id": "req-0050"}
+{"timestamp": "2024-01-15T02:33:00Z", "level": "INFO", "source": "auth", "message": "Token validated", "req_id": "req-0051"}
+{"timestamp": "2024-01-15T02:36:00Z", "level": "TRACE", "source": "cache", "message": "Connection timeout", "req_id": "req-0052"}
+{"timestamp": "2024-01-15T02:39:00Z", "level": "TRACE", "source": "mailer", "message": "Auth failed", "req_id": "req-0053"}
+{"timestamp": "2024-01-15T02:42:00Z", "level": "FATAL", "source": "mailer", "message": "Email queued", "req_id": "req-0054"}
+{"timestamp": "2024-01-15T02:45:00Z", "level": "INFO", "source": "cache", "message": "Job started", "req_id": "req-0055"}
+{"timestamp": "2024-01-15T02:48:00Z", "level": "TRACE", "source": "webserver", "message": "Job started", "req_id": "req-0056"}
+{"timestamp": "2024-01-15T02:51:00Z", "level": "FATAL", "source": "scheduler", "message": "Auth failed", "req_id": "req-0057"}
+{"timestamp": "2024-01-15T02:54:00Z", "level": "DEBUG", "source": "cache", "message": "Query executed", "req_id": "req-0058"}
+{"timestamp": "2024-01-15T02:57:00Z", "level": "ERROR", "source": "cache", "message": "Auth failed", "req_id": "req-0059"}
+{"timestamp": "2024-01-15T03:00:00Z", "level": "INFO", "source": "cache", "message": "Cache miss", "req_id": "req-0060"}
+{"timestamp": "2024-01-15T03:03:00Z", "level": "INFO", "source": "cache", "message": "Cache hit", "req_id": "req-0061"}
+{"timestamp": "2024-01-15T03:06:00Z", "level": "INFO", "source": "database", "message": "Cache hit", "req_id": "req-0062"}
+{"timestamp": "2024-01-15T03:09:00Z", "level": "INFO", "source": "webserver", "message": "Unexpected state", "req_id": "req-0063"}
+{"timestamp": "2024-01-15T03:12:00Z", "level": "ERROR", "source": "webserver", "message": "Cache miss", "req_id": "req-0064"}
+{"timestamp": "2024-01-15T03:15:00Z", "level": "FATAL", "source": "auth", "message": "Request received", "req_id": "req-0065"}
+{"timestamp": "2024-01-15T03:18:00Z", "level": "TRACE", "source": "auth", "message": "Disk I/O error", "req_id": "req-0066"}
+{"timestamp": "2024-01-15T03:21:00Z", "level": "INFO", "source": "mailer", "message": "Email queued", "req_id": "req-0067"}
+{"timestamp": "2024-01-15T03:24:00Z", "level": "INFO", "source": "cache", "message": "Connection timeout", "req_id": "req-0068"}
+{"timestamp": "2024-01-15T03:27:00Z", "level": "FATAL", "source": "database", "message": "Email queued", "req_id": "req-0069"}
+{"timestamp": "2024-01-15T03:30:00Z", "level": "FATAL", "source": "cache", "message": "Slow query", "req_id": "req-0070"}
+{"timestamp": "2024-01-15T03:33:00Z", "level": "INFO", "source": "cache", "message": "Job started", "req_id": "req-0071"}
+{"timestamp": "2024-01-15T03:36:00Z", "level": "INFO", "source": "webserver", "message": "Slow query", "req_id": "req-0072"}
+{"timestamp": "2024-01-15T03:39:00Z", "level": "INFO", "source": "auth", "message": "Connection timeout", "req_id": "req-0073"}
+{"timestamp": "2024-01-15T03:42:00Z", "level": "ERROR", "source": "scheduler", "message": "Query executed", "req_id": "req-0074"}
+{"timestamp": "2024-01-15T03:45:00Z", "level": "TRACE", "source": "webserver", "message": "Request received", "req_id": "req-0075"}
+{"timestamp": "2024-01-15T03:48:00Z", "level": "WARN", "source": "webserver", "message": "Query executed", "req_id": "req-0076"}
+{"timestamp": "2024-01-15T03:51:00Z", "level": "WARN", "source": "cache", "message": "Cache miss", "req_id": "req-0077"}
+{"timestamp": "2024-01-15T03:54:00Z", "level": "INFO", "source": "scheduler", "message": "Cache miss", "req_id": "req-0078"}
+{"timestamp": "2024-01-15T03:57:00Z", "level": "INFO", "source": "scheduler", "message": "Query executed", "req_id": "req-0079"}
+{"timestamp": "2024-01-15T04:00:00Z", "level": "TRACE", "source": "mailer", "message": "Job started", "req_id": "req-0080"}
+{"timestamp": "2024-01-15T04:03:00Z", "level": "INFO", "source": "scheduler", "message": "Cache hit", "req_id": "req-0081"}
+{"timestamp": "2024-01-15T04:06:00Z", "level": "FATAL", "source": "database", "message": "Token validated", "req_id": "req-0082"}
+{"timestamp": "2024-01-15T04:09:00Z", "level": "INFO", "source": "webserver", "message": "Cache miss", "req_id": "req-0083"}
+{"timestamp": "2024-01-15T04:12:00Z", "level": "FATAL", "source": "mailer", "message": "Disk I/O error", "req_id": "req-0084"}
+{"timestamp": "2024-01-15T04:15:00Z", "level": "WARN", "source": "webserver", "message": "Unexpected state", "req_id": "req-0085"}
+{"timestamp": "2024-01-15T04:18:00Z", "level": "INFO", "source": "webserver", "message": "Slow query", "req_id": "req-0086"}
+{"timestamp": "2024-01-15T04:21:00Z", "level": "INFO", "source": "webserver", "message": "Auth failed", "req_id": "req-0087"}
+{"timestamp": "2024-01-15T04:24:00Z", "level": "TRACE", "source": "scheduler", "message": "Cache hit", "req_id": "req-0088"}
+{"timestamp": "2024-01-15T04:27:00Z", "level": "INFO", "source": "cache", "message": "Query executed", "req_id": "req-0089"}
+{"timestamp": "2024-01-15T04:30:00Z", "level": "DEBUG", "source": "mailer", "message": "Token validated", "req_id": "req-0090"}
+{"timestamp": "2024-01-15T04:33:00Z", "level": "INFO", "source": "scheduler", "message": "Disk I/O error", "req_id": "req-0091"}
+{"timestamp": "2024-01-15T04:36:00Z", "level": "WARN", "source": "scheduler", "message": "Job started", "req_id": "req-0092"}
+{"timestamp": "2024-01-15T04:39:00Z", "level": "TRACE", "source": "database", "message": "Cache miss", "req_id": "req-0093"}
+{"timestamp": "2024-01-15T04:42:00Z", "level": "WARN", "source": "database", "message": "Disk I/O error", "req_id": "req-0094"}
+{"timestamp": "2024-01-15T04:45:00Z", "level": "INFO", "source": "scheduler", "message": "Cache hit", "req_id": "req-0095"}
+{"timestamp": "2024-01-15T04:48:00Z", "level": "ERROR", "source": "database", "message": "Cache miss", "req_id": "req-0096"}
+{"timestamp": "2024-01-15T04:51:00Z", "level": "WARN", "source": "webserver", "message": "Job started", "req_id": "req-0097"}
+{"timestamp": "2024-01-15T04:54:00Z", "level": "DEBUG", "source": "scheduler", "message": "Token validated", "req_id": "req-0098"}
+{"timestamp": "2024-01-15T04:57:00Z", "level": "TRACE", "source": "scheduler", "message": "Auth failed", "req_id": "req-0099"}
+{"timestamp": "2024-01-15T05:00:00Z", "level": "INFO", "source": "webserver", "message": "Cache hit", "req_id": "req-0100"}
+{"timestamp": "2024-01-15T05:03:00Z", "level": "INFO", "source": "scheduler", "message": "Disk I/O error", "req_id": "req-0101"}
+{"timestamp": "2024-01-15T05:06:00Z", "level": "INFO", "source": "auth", "message": "Query executed", "req_id": "req-0102"}
+{"timestamp": "2024-01-15T05:09:00Z", "level": "ERROR", "source": "webserver", "message": "Cache miss", "req_id": "req-0103"}
+{"timestamp": "2024-01-15T05:12:00Z", "level": "TRACE", "source": "auth", "message": "Cache hit", "req_id": "req-0104"}
+{"timestamp": "2024-01-15T05:15:00Z", "level": "WARN", "source": "mailer", "message": "Email queued", "req_id": "req-0105"}
+{"timestamp": "2024-01-15T05:18:00Z", "level": "ERROR", "source": "webserver", "message": "Request received", "req_id": "req-0106"}
+{"timestamp": "2024-01-15T05:21:00Z", "level": "DEBUG", "source": "cache", "message": "Cache miss", "req_id": "req-0107"}
+{"timestamp": "2024-01-15T05:24:00Z", "level": "DEBUG", "source": "webserver", "message": "Disk I/O error", "req_id": "req-0108"}
+{"timestamp": "2024-01-15T05:27:00Z", "level": "INFO", "source": "mailer", "message": "Cache hit", "req_id": "req-0109"}
+{"timestamp": "2024-01-15T05:30:00Z", "level": "ERROR", "source": "cache", "message": "Cache miss", "req_id": "req-0110"}
+{"timestamp": "2024-01-15T05:33:00Z", "level": "INFO", "source": "cache", "message": "Slow query", "req_id": "req-0111"}
+{"timestamp": "2024-01-15T05:36:00Z", "level": "FATAL", "source": "auth", "message": "Cache hit", "req_id": "req-0112"}
+{"timestamp": "2024-01-15T05:39:00Z", "level": "ERROR", "source": "cache", "message": "Slow query", "req_id": "req-0113"}
+{"timestamp": "2024-01-15T05:42:00Z", "level": "INFO", "source": "cache", "message": "Cache miss", "req_id": "req-0114"}
+{"timestamp": "2024-01-15T05:45:00Z", "level": "TRACE", "source": "webserver", "message": "Cache miss", "req_id": "req-0115"}
+{"timestamp": "2024-01-15T05:48:00Z", "level": "INFO", "source": "mailer", "message": "Auth failed", "req_id": "req-0116"}
+{"timestamp": "2024-01-15T05:51:00Z", "level": "FATAL", "source": "scheduler", "message": "Connection timeout", "req_id": "req-0117"}
+{"timestamp": "2024-01-15T05:54:00Z", "level": "INFO", "source": "cache", "message": "Cache miss", "req_id": "req-0118"}
+{"timestamp": "2024-01-15T05:57:00Z", "level": "INFO", "source": "cache", "message": "Connection timeout", "req_id": "req-0119"}
+{"timestamp": "2024-01-15T06:00:00Z", "level": "FATAL", "source": "mailer", "message": "Email queued", "req_id": "req-0120"}
+{"timestamp": "2024-01-15T06:03:00Z", "level": "FATAL", "source": "database", "message": "Email queued", "req_id": "req-0121"}
+{"timestamp": "2024-01-15T06:06:00Z", "level": "INFO", "source": "mailer", "message": "Token validated", "req_id": "req-0122"}
+{"timestamp": "2024-01-15T06:09:00Z", "level": "INFO", "source": "mailer", "message": "Disk I/O error", "req_id": "req-0123"}
+{"timestamp": "2024-01-15T06:12:00Z", "level": "TRACE", "source": "scheduler", "message": "Query executed", "req_id": "req-0124"}
+{"timestamp": "2024-01-15T06:15:00Z", "level": "WARN", "source": "auth", "message": "Auth failed", "req_id": "req-0125"}
+{"timestamp": "2024-01-15T06:18:00Z", "level": "WARN", "source": "webserver", "message": "Cache miss", "req_id": "req-0126"}
+{"timestamp": "2024-01-15T06:21:00Z", "level": "INFO", "source": "scheduler", "message": "Query executed", "req_id": "req-0127"}
+{"timestamp": "2024-01-15T06:24:00Z", "level": "INFO", "source": "mailer", "message": "Cache miss", "req_id": "req-0128"}
+{"timestamp": "2024-01-15T06:27:00Z", "level": "DEBUG", "source": "scheduler", "message": "Request received", "req_id": "req-0129"}
+{"timestamp": "2024-01-15T06:30:00Z", "level": "WARN", "source": "cache", "message": "Unexpected state", "req_id": "req-0130"}
+{"timestamp": "2024-01-15T06:33:00Z", "level": "TRACE", "source": "auth", "message": "Connection timeout", "req_id": "req-0131"}
+{"timestamp": "2024-01-15T06:36:00Z", "level": "FATAL", "source": "auth", "message": "Cache miss", "req_id": "req-0132"}
+{"timestamp": "2024-01-15T06:39:00Z", "level": "INFO", "source": "scheduler", "message": "Slow query", "req_id": "req-0133"}
+{"timestamp": "2024-01-15T06:42:00Z", "level": "INFO", "source": "scheduler", "message": "Connection timeout", "req_id": "req-0134"}
+{"timestamp": "2024-01-15T06:45:00Z", "level": "ERROR", "source": "scheduler", "message": "Job started", "req_id": "req-0135"}
+{"timestamp": "2024-01-15T06:48:00Z", "level": "DEBUG", "source": "mailer", "message": "Slow query", "req_id": "req-0136"}
+{"timestamp": "2024-01-15T06:51:00Z", "level": "ERROR", "source": "auth", "message": "Request received", "req_id": "req-0137"}
+{"timestamp": "2024-01-15T06:54:00Z", "level": "DEBUG", "source": "webserver", "message": "Disk I/O error", "req_id": "req-0138"}
+{"timestamp": "2024-01-15T06:57:00Z", "level": "FATAL", "source": "database", "message": "Unexpected state", "req_id": "req-0139"}
+{"timestamp": "2024-01-15T07:00:00Z", "level": "ERROR", "source": "database", "message": "Token validated", "req_id": "req-0140"}
+{"timestamp": "2024-01-15T07:03:00Z", "level": "FATAL", "source": "scheduler", "message": "Cache hit", "req_id": "req-0141"}
+{"timestamp": "2024-01-15T07:06:00Z", "level": "WARN", "source": "webserver", "message": "Cache miss", "req_id": "req-0142"}
+{"timestamp": "2024-01-15T07:09:00Z", "level": "DEBUG", "source": "cache", "message": "Cache hit", "req_id": "req-0143"}
+{"timestamp": "2024-01-15T07:12:00Z", "level": "INFO", "source": "auth", "message": "Unexpected state", "req_id": "req-0144"}
+{"timestamp": "2024-01-15T07:15:00Z", "level": "INFO", "source": "scheduler", "message": "Connection timeout", "req_id": "req-0145"}
+{"timestamp": "2024-01-15T07:18:00Z", "level": "DEBUG", "source": "auth", "message": "Request received", "req_id": "req-0146"}
+{"timestamp": "2024-01-15T07:21:00Z", "level": "DEBUG", "source": "cache", "message": "Unexpected state", "req_id": "req-0147"}
+{"timestamp": "2024-01-15T07:24:00Z", "level": "INFO", "source": "mailer", "message": "Auth failed", "req_id": "req-0148"}
+{"timestamp": "2024-01-15T07:27:00Z", "level": "FATAL", "source": "webserver", "message": "Cache hit", "req_id": "req-0149"}
+{"timestamp": "2024-01-15T07:30:00Z", "level": "DEBUG", "source": "webserver", "message": "Request received", "req_id": "req-0150"}
+{"timestamp": "2024-01-15T07:33:00Z", "level": "FATAL", "source": "auth", "message": "Cache hit", "req_id": "req-0151"}
+{"timestamp": "2024-01-15T07:36:00Z", "level": "ERROR", "source": "auth", "message": "Disk I/O error", "req_id": "req-0152"}
+{"timestamp": "2024-01-15T07:39:00Z", "level": "TRACE", "source": "webserver", "message": "Request received", "req_id": "req-0153"}
+{"timestamp": "2024-01-15T07:42:00Z", "level": "WARN", "source": "database", "message": "Unexpected state", "req_id": "req-0154"}
+{"timestamp": "2024-01-15T07:45:00Z", "level": "INFO", "source": "webserver", "message": "Email queued", "req_id": "req-0155"}
+{"timestamp": "2024-01-15T07:48:00Z", "level": "DEBUG", "source": "database", "message": "Unexpected state", "req_id": "req-0156"}
+{"timestamp": "2024-01-15T07:51:00Z", "level": "DEBUG", "source": "scheduler", "message": "Request received", "req_id": "req-0157"}
+{"timestamp": "2024-01-15T07:54:00Z", "level": "FATAL", "source": "cache", "message": "Request received", "req_id": "req-0158"}
+{"timestamp": "2024-01-15T07:57:00Z", "level": "TRACE", "source": "cache", "message": "Cache hit", "req_id": "req-0159"}
+{"timestamp": "2024-01-15T08:00:00Z", "level": "FATAL", "source": "auth", "message": "Request received", "req_id": "req-0160"}
+{"timestamp": "2024-01-15T08:03:00Z", "level": "INFO", "source": "scheduler", "message": "Auth failed", "req_id": "req-0161"}
+{"timestamp": "2024-01-15T08:06:00Z", "level": "DEBUG", "source": "auth", "message": "Email queued", "req_id": "req-0162"}
+{"timestamp": "2024-01-15T08:09:00Z", "level": "INFO", "source": "mailer", "message": "Auth failed", "req_id": "req-0163"}
+{"timestamp": "2024-01-15T08:12:00Z", "level": "INFO", "source": "auth", "message": "Connection timeout", "req_id": "req-0164"}
+{"timestamp": "2024-01-15T08:15:00Z", "level": "WARN", "source": "database", "message": "Unexpected state", "req_id": "req-0165"}
+{"timestamp": "2024-01-15T08:18:00Z", "level": "ERROR", "source": "cache", "message": "Auth failed", "req_id": "req-0166"}
+{"timestamp": "2024-01-15T08:21:00Z", "level": "INFO", "source": "scheduler", "message": "Request received", "req_id": "req-0167"}
+{"timestamp": "2024-01-15T08:24:00Z", "level": "FATAL", "source": "auth", "message": "Email queued", "req_id": "req-0168"}
+{"timestamp": "2024-01-15T08:27:00Z", "level": "INFO", "source": "mailer", "message": "Unexpected state", "req_id": "req-0169"}
+{"timestamp": "2024-01-15T08:30:00Z", "level": "INFO", "source": "mailer", "message": "Unexpected state", "req_id": "req-0170"}
+{"timestamp": "2024-01-15T08:33:00Z", "level": "ERROR", "source": "webserver", "message": "Disk I/O error", "req_id": "req-0171"}
+{"timestamp": "2024-01-15T08:36:00Z", "level": "FATAL", "source": "webserver", "message": "Auth failed", "req_id": "req-0172"}
+{"timestamp": "2024-01-15T08:39:00Z", "level": "INFO", "source": "scheduler", "message": "Slow query", "req_id": "req-0173"}
+{"timestamp": "2024-01-15T08:42:00Z", "level": "INFO", "source": "mailer", "message": "Job started", "req_id": "req-0174"}
+{"timestamp": "2024-01-15T08:45:00Z", "level": "FATAL", "source": "mailer", "message": "Cache hit", "req_id": "req-0175"}
+{"timestamp": "2024-01-15T08:48:00Z", "level": "INFO", "source": "cache", "message": "Auth failed", "req_id": "req-0176"}
+{"timestamp": "2024-01-15T08:51:00Z", "level": "TRACE", "source": "webserver", "message": "Query executed", "req_id": "req-0177"}
+{"timestamp": "2024-01-15T08:54:00Z", "level": "INFO", "source": "database", "message": "Auth failed", "req_id": "req-0178"}
+{"timestamp": "2024-01-15T08:57:00Z", "level": "INFO", "source": "mailer", "message": "Connection timeout", "req_id": "req-0179"}
+{"timestamp": "2024-01-15T09:00:00Z", "level": "INFO", "source": "cache", "message": "Cache miss", "req_id": "req-0180"}
+{"timestamp": "2024-01-15T09:03:00Z", "level": "ERROR", "source": "database", "message": "Token validated", "req_id": "req-0181"}
+{"timestamp": "2024-01-15T09:06:00Z", "level": "INFO", "source": "database", "message": "Job started", "req_id": "req-0182"}
+{"timestamp": "2024-01-15T09:09:00Z", "level": "INFO", "source": "auth", "message": "Cache hit", "req_id": "req-0183"}
+{"timestamp": "2024-01-15T09:12:00Z", "level": "FATAL", "source": "cache", "message": "Unexpected state", "req_id": "req-0184"}
+{"timestamp": "2024-01-15T09:15:00Z", "level": "WARN", "source": "mailer", "message": "Cache hit", "req_id": "req-0185"}
+{"timestamp": "2024-01-15T09:18:00Z", "level": "INFO", "source": "database", "message": "Token validated", "req_id": "req-0186"}
+{"timestamp": "2024-01-15T09:21:00Z", "level": "ERROR", "source": "database", "message": "Token validated", "req_id": "req-0187"}
+{"timestamp": "2024-01-15T09:24:00Z", "level": "TRACE", "source": "database", "message": "Unexpected state", "req_id": "req-0188"}
+{"timestamp": "2024-01-15T09:27:00Z", "level": "ERROR", "source": "mailer", "message": "Request received", "req_id": "req-0189"}
+{"timestamp": "2024-01-15T09:30:00Z", "level": "INFO", "source": "database", "message": "Query executed", "req_id": "req-0190"}
+{"timestamp": "2024-01-15T09:33:00Z", "level": "ERROR", "source": "cache", "message": "Cache hit", "req_id": "req-0191"}
+{"timestamp": "2024-01-15T09:36:00Z", "level": "TRACE", "source": "cache", "message": "Unexpected state", "req_id": "req-0192"}
+{"timestamp": "2024-01-15T09:39:00Z", "level": "DEBUG", "source": "cache", "message": "Job started", "req_id": "req-0193"}
+{"timestamp": "2024-01-15T09:42:00Z", "level": "INFO", "source": "mailer", "message": "Query executed", "req_id": "req-0194"}
+{"timestamp": "2024-01-15T09:45:00Z", "level": "INFO", "source": "scheduler", "message": "Cache miss", "req_id": "req-0195"}
+{"timestamp": "2024-01-15T09:48:00Z", "level": "FATAL", "source": "scheduler", "message": "Cache miss", "req_id": "req-0196"}
+{"timestamp": "2024-01-15T09:51:00Z", "level": "INFO", "source": "auth", "message": "Connection timeout", "req_id": "req-0197"}
+{"timestamp": "2024-01-15T09:54:00Z", "level": "ERROR", "source": "database", "message": "Auth failed", "req_id": "req-0198"}
+{"timestamp": "2024-01-15T09:57:00Z", "level": "DEBUG", "source": "cache", "message": "Slow query", "req_id": "req-0199"}
diff --git a/tests/fixtures/sample.log b/tests/fixtures/sample.log
new file mode 100644
index 0000000..387ad96
--- /dev/null
+++ b/tests/fixtures/sample.log
@@ -0,0 +1,18 @@
+2024-01-15T08:00:00Z INFO [startup] Application starting
+2024-01-15T08:00:01Z INFO [config] Loaded configuration from /etc/app/config.yaml
+2024-01-15T08:00:02Z DEBUG [database] Connecting to postgres://localhost:5432/app
+2024-01-15T08:00:03Z INFO [database] Connection pool initialized (size=10)
+2024-01-15T08:00:04Z INFO [webserver] Listening on 0.0.0.0:8080
+2024-01-15T09:15:22Z INFO [webserver] GET /api/users 200 45ms
+2024-01-15T09:15:23Z INFO [webserver] POST /api/login 200 120ms
+2024-01-15T09:30:01Z WARN [database] Slow query detected (query_time=2300ms)
+2024-01-15T10:00:00Z ERROR [database] Connection pool exhausted (active=10, waiting=5)
+2024-01-15T10:00:01Z ERROR [webserver] GET /api/data 503 timeout
+2024-01-15T10:00:05Z WARN [database] Retrying connection...
+2024-01-15T10:00:07Z INFO [database] Connection restored
+2024-01-15T11:00:00Z DEBUG [cache] Cache hit ratio: 0.87
+2024-01-15T12:00:00Z INFO [health] Health check passed
+2024-01-15T14:30:00Z WARN [memory] Memory usage at 78%
+2024-01-15T14:30:10Z WARN [memory] Memory usage at 85%
+2024-01-15T14:30:20Z ERROR [memory] Memory usage at 95%, triggering GC
+2024-01-15T14:30:21Z FATAL [runtime] Out of memory - process terminating
diff --git a/tests/integration_tests.rs b/tests/integration_tests.rs
new file mode 100644
index 0000000..e967ffc
--- /dev/null
+++ b/tests/integration_tests.rs
@@ -0,0 +1,124 @@
+use logagg::{LogAnalyzer, LogLevel};
+use std::io::Write;
+use std::path::PathBuf;
+use tempfile::NamedTempFile;
+
+#[test]
+fn test_analyze_multiple_files() {
+ let mut file1 = NamedTempFile::new().unwrap();
+ writeln!(file1, r#"{{"level":"ERROR","message":"Error 1"}}"#).unwrap();
+ writeln!(file1, r#"{{"level":"INFO","message":"Info 1"}}"#).unwrap();
+
+ let mut file2 = NamedTempFile::new().unwrap();
+ writeln!(file2, r#"{{"level":"ERROR","message":"Error 2"}}"#).unwrap();
+
+ let paths = vec![
+ PathBuf::from(file1.path()),
+ PathBuf::from(file2.path()),
+ ];
+
+ let analyzer = LogAnalyzer::load_files(&paths).unwrap();
+ let result = analyzer.filter_by_level(LogLevel::Error).analyze();
+
+ assert_eq!(result.count, 2);
+}
+
+#[test]
+fn test_filter_by_time_range() {
+ let mut file = NamedTempFile::new().unwrap();
+ writeln!(file, r#"{{"timestamp":"2024-01-15T10:00:00Z","level":"ERROR"}}"#).unwrap();
+ writeln!(file, r#"{{"timestamp":"2024-01-15T12:00:00Z","level":"ERROR"}}"#).unwrap();
+ writeln!(file, r#"{{"timestamp":"2024-01-15T14:00:00Z","level":"ERROR"}}"#).unwrap();
+
+ let analyzer = LogAnalyzer::load_files(&[PathBuf::from(file.path())]).unwrap();
+
+ let from = "2024-01-15T09:00:00Z".parse().unwrap();
+ let to = "2024-01-15T13:00:00Z".parse().unwrap();
+
+ let result = analyzer.filter_by_time_range(from, to).analyze();
+ assert_eq!(result.count, 2);
+}
+
+#[test]
+fn test_filter_by_source() {
+ let mut file = NamedTempFile::new().unwrap();
+ writeln!(file, r#"{{"level":"ERROR","source":"database","message":"deadlock"}}"#).unwrap();
+ writeln!(file, r#"{{"level":"ERROR","source":"webserver","message":"500"}}"#).unwrap();
+ writeln!(file, r#"{{"level":"ERROR","source":"database","message":"timeout"}}"#).unwrap();
+
+ let analyzer = LogAnalyzer::load_files(&[PathBuf::from(file.path())]).unwrap();
+ let result = analyzer.filter_by_source("database").analyze();
+
+ assert_eq!(result.count, 2);
+}
+
+#[test]
+fn test_filter_by_message_pattern() {
+ let mut file = NamedTempFile::new().unwrap();
+ writeln!(file, r#"{{"level":"ERROR","message":"Connection timeout"}}"#).unwrap();
+ writeln!(file, r#"{{"level":"ERROR","message":"Disk full"}}"#).unwrap();
+ writeln!(file, r#"{{"level":"WARN","message":"High memory: timeout risk"}}"#).unwrap();
+
+ let analyzer = LogAnalyzer::load_files(&[PathBuf::from(file.path())]).unwrap();
+ let result = analyzer.filter_by_message("timeout").analyze();
+
+ assert_eq!(result.count, 2);
+}
+
+#[test]
+fn test_empty_file() {
+ let file = NamedTempFile::new().unwrap();
+ let analyzer = LogAnalyzer::load_files(&[PathBuf::from(file.path())]).unwrap();
+ let result = analyzer.analyze();
+ assert_eq!(result.count, 0);
+ assert_eq!(result.error_rate, 0.0);
+}
+
+#[test]
+fn test_error_rate_calculation() {
+ let mut file = NamedTempFile::new().unwrap();
+ writeln!(file, r#"{{"level":"INFO","message":"startup"}}"#).unwrap();
+ writeln!(file, r#"{{"level":"INFO","message":"running"}}"#).unwrap();
+ writeln!(file, r#"{{"level":"ERROR","message":"crash"}}"#).unwrap();
+ writeln!(file, r#"{{"level":"FATAL","message":"panic"}}"#).unwrap();
+
+ let analyzer = LogAnalyzer::load_files(&[PathBuf::from(file.path())]).unwrap();
+ let result = analyzer.analyze();
+
+ assert_eq!(result.count, 4);
+ assert!((result.error_rate - 50.0).abs() < f64::EPSILON);
+}
+
+#[test]
+fn test_structured_log_parsing() {
+ let mut file = NamedTempFile::new().unwrap();
+ writeln!(
+ file,
+ r#"ts=2024-01-15T12:00:00Z level=error source=db msg="deadlock detected""#
+ )
+ .unwrap();
+ writeln!(
+ file,
+ r#"ts=2024-01-15T12:01:00Z level=info source=api msg="request ok""#
+ )
+ .unwrap();
+
+ let analyzer = LogAnalyzer::load_files(&[PathBuf::from(file.path())]).unwrap();
+ let result = analyzer.filter_by_level(LogLevel::Error).analyze();
+
+ assert_eq!(result.count, 1);
+}
+
+#[test]
+fn test_regex_log_parsing() {
+ let mut file = NamedTempFile::new().unwrap();
+ writeln!(file, "2024-01-15T12:00:00Z ERROR [myapp] Connection refused").unwrap();
+ writeln!(file, "2024-01-15T12:00:01Z INFO [myapp] Retrying...").unwrap();
+ writeln!(file, "2024-01-15T12:00:02Z WARN [myapp] Slow response").unwrap();
+
+ let analyzer = LogAnalyzer::load_files(&[PathBuf::from(file.path())]).unwrap();
+ let result = analyzer.analyze();
+
+ assert_eq!(result.count, 3);
+ assert_eq!(*result.level_counts.get("ERROR").unwrap_or(&0), 1);
+}
-
-