model

Documentation

Index

• type Entry
• type Schema
  • func NewSchema(exclude []string) Schema
  • func (s Schema) Entry(entry journal.Entry) Entry
  • func (s Schema) Excluded() map[string]struct{}
  • func (s Schema) FieldName(name string) string
  • func (s Schema) IsLabel(name string) bool
  • func (s Schema) LabelNames() []string
  • func (s Schema) StreamLabels(fields map[string]string) labels.Labels
  • func (s Schema) StreamLabelsMap(fields map[string]string) map[string]string
  • func (s Schema) StructuredMetadata(fields map[string]string) labels.Labels
  • func (s Schema) StructuredMetadataMap(fields map[string]string) map[string]string

Types

type Entry

type Entry struct {
	Timestamp          time.Time
	Line               string
	StreamLabels       labels.Labels
	StructuredMetadata labels.Labels
}

Entry is a log entry with processed line, stream labels, and structured metadata — the inputs consumed by LogPipeline and MetricPipeline.

type Schema

type Schema struct {
	// Exclude lists high-cardinality fields that should NOT be stream labels.
	// These become structured metadata instead, still queryable via LogQL
	// label filter expressions but not included in the stream identity.
	Exclude []string
}

Schema defines which journald fields become structured metadata (i.e., not stream labels). The MESSAGE field is always mapped to the log line. All other fields become stream labels by default.

func NewSchema

func NewSchema(exclude []string) Schema

NewSchema creates a Schema with deduplicated excluded field names.

func (Schema) Entry

func (s Schema) Entry(entry journal.Entry) Entry

Entry converts a journal.Entry into a Loki-compatible representation. MESSAGE becomes the Line, excluded fields become structured metadata, and all other fields become stream labels. All field values are sanitized to valid UTF-8 because journald may contain binary data that cannot be transmitted in a WebSocket text frame.

func (Schema) Excluded

func (s Schema) Excluded() map[string]struct{}

Excluded returns a case-insensitive set of excluded field names.

func (Schema) FieldName

func (s Schema) FieldName(name string) string

FieldName resolves a case-insensitive name to its original case. Checks Exclude first, then returns name unchanged (the caller should validate via IsLabel or verify against the journal).

func (Schema) IsLabel

func (s Schema) IsLabel(name string) bool

IsLabel reports whether name is NOT excluded and NOT MESSAGE, using case-insensitive comparison.

func (Schema) LabelNames

func (s Schema) LabelNames() []string

LabelNames returns all excluded field names lowercased.

func (Schema) StreamLabels

func (s Schema) StreamLabels(fields map[string]string) labels.Labels

StreamLabels builds a labels.Labels from all non-excluded, non-MESSAGE fields.

func (Schema) StreamLabelsMap

func (s Schema) StreamLabelsMap(fields map[string]string) map[string]string

StreamLabelsMap returns all fields that are NOT excluded and NOT MESSAGE, with lowercased keys.

func (Schema) StructuredMetadata

func (s Schema) StructuredMetadata(fields map[string]string) labels.Labels

StructuredMetadata builds a labels.Labels from excluded fields only.

func (Schema) StructuredMetadataMap

func (s Schema) StructuredMetadataMap(fields map[string]string) map[string]string

StructuredMetadataMap returns only excluded fields as a plain map with lowercased keys. MESSAGE is always excluded from metadata.