Skip to content

log: add OpenTelemetry + text log renderers - #41

Merged
achille-roussel merged 1 commit into
mainfrom
logs
May 27, 2026
Merged

log: add OpenTelemetry + text log renderers#41
achille-roussel merged 1 commit into
mainfrom
logs

Conversation

@achille-roussel

Copy link
Copy Markdown
Contributor

Summary

  • New stripes/log package — one renderer for both OpenTelemetry log batches (binary / protojson, MIME application/vnd.opentelemetry.logs) and line-oriented text log formats (logfmt, jsonlog, AWS ALB, NGINX, log4j/Kafka, Python logging, Go stdlib log, BSD/RFC 5424 syslog).
  • Unified per-record layout: yyyy/mm/dd hh:mm:ss.mmm LEVEL metadata message header with attributes indented underneath, keys aligned on a separator. Timestamps normalise to local time; severity is a fixed 4-char coloured label (TRAC/DEBU cyan, INFO green, WARN yellow, ERRO red, FATA purple).
  • HTTP access logs drop the level column (status code carries severity), surface every documented ALB field as attrs named per AWS docs, colour the HTTP method by class (GET blue, POST orange, PUT magenta, PATCH purple, DELETE pink), and dim the HTTP/x.y version suffix.
  • Multi-line content folds into the preceding record's message: matching lines start a new record; non-matching and whitespace-prefixed lines append to it. Go panic dumps and exception traces render verbatim (no wrapper indent) so their own indentation shows through.
  • CLI gains per-format --format aliases and derives compression from the filename when Content-Encoding is absent, so s3://…/foo.log.gz "just works."
  • json/detectJSON tightened to require a parseable first JSON value, so log4j's bracketed timestamps no longer false-positive into the JSON renderer.

Test plan

  • go build ./... clean
  • go vet ./... clean
  • gofmt -l . clean
  • go test -count=1 ./... — all packages green, including the existing testdata/script/*.txtar detection-priority tests
  • New testdata/script/detect_log.txtar covers content-based detection across every text log format
  • testdata/log/ fixtures render correctly under their auto-detected format and under explicit --format= flags
  • testdata/log/otlp.binpb (regenerable via go run ./testdata/log/gen) renders under both --format=logs and --schema=opentelemetry.proto.logs.v1.LogsData
  • Manual smoke against a real s3://…elasticloadbalancing/…log.gz (auto-decompresses, auto-detects ALB)

🤖 Generated with Claude Code

Adds the stripes/log package, a unified renderer for both
OpenTelemetry log batches (binary or protojson) and line-oriented
text log formats (logfmt, jsonlog, AWS ALB and NGINX access logs,
log4j/Kafka, Python logging, Go stdlib log, BSD/RFC 5424 syslog).

Every record renders in the same shape — a single header line of
fixed-width columns (timestamp, optional level, format-specific
metadata, message) followed by indented attribute lines only when
the record has any. Timestamps normalise to local time; severities
get a fixed 4-char coloured label (TRAC/DEBU cyan, INFO green,
WARN yellow, ERRO red, FATA purple). HTTP access logs drop the
level column (the status code carries severity), colour the
method by class (GET blue, POST orange, PUT magenta, PATCH
purple, DELETE pink), and dim the protocol-version suffix.

Multi-line content folds into the preceding record's message:
matching lines start a new record; non-matching and
whitespace-prefixed lines append to it. Stack traces, Go panic
dumps, and exception traces stay attached to their log line and
render verbatim (no wrapper indent) so the trace's own
indentation shows through.

The CLI gains --format aliases (logs, logfmt, jsonlog,
alb-access, nginx-access, log4j, python-log, go-log, syslog,
syslog-rfc5424) and learns to derive compression from the
filename when Content-Encoding is absent so .log.gz from S3
"just works." json's Detect now requires a parseable first JSON
value so log4j's bracketed timestamps stop tripping it.

testdata/log/ ships representative fixtures for each format,
including a Go panic in golog.log and a reproducible OTLP binpb
generated by testdata/log/gen.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@achille-roussel
achille-roussel merged commit 904316e into main May 27, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant