#groklite

中文一句话：把非结构化日志行按 grok 风格模式拆成命名字段，纯计算、无 IO、多目标可用。

%{IP:client} %{WORD:method} %{NUMBER:status}

#Demo

#Install

moon add qqq66668/groklite

import {
  "qqq66668/groklite/src" @groklite,
}

fn main {
  let pattern = "%{IP:client} %{WORD:method} %{STATUS:status}"
  match @groklite.compile_builtin(pattern) {
    Err(error) => println(@groklite.describe_compile_error(error))
    Ok(program) => {
      match @groklite.match_line(program, "10.0.0.7 GET 404") {
        Err(error) => println(@groklite.describe_match_error(error))
        Ok(fields) => {
          match @groklite.field_value(fields, "status") {
            Some(value) => println(value)
            None => println("no status field")
          }
        }
      }
    }
  }
}

#Shape

• src/syntax turns pattern text into ordered segments and reports offsets.
• src/registry maps a pattern name to a rule.
• src/compile expands references and lowers them into a matcher program.
• src/engine executes that program over one line.

#What works today

1. parse turns pattern text into literal and reference segments, and reports a malformed pattern with an offset and a caret line.
2. builtin ships 16 curated rules: the access-log core plus the syslog prefix.
3. parse_rule reads a rule body into a node tree: bracket classes, shorthand escapes, groups, alternation, anchors and bounded repetition.
4. compile lowers segments into a program with numbered capture slots and a field table, refusing a duplicate field, an unknown rule and a malformed body at compile time.
5. match_line runs a program over one line and returns a field table. Matching is whole-line: a partial match is a failure, not a best-effort result. Every pass is bounded by a step budget, and running out is reported rather than hidden.
6. match_first tries compiled programs in order and reports the first whole-line match, so a stream that mixes formats needs one pass instead of one branch per format.

#Run the example

moon run examples/nginx_to_json

client=10.0.0.7
method=GET
status=404

#A second format

moon run examples/syslog_to_json

pattern=0
ts=Jan  5 14:22:01
host=web-01
prog=sshd
msg=panic

#Provenance

#Verify the claims

moon check --deny-warn
moon test
moon run examples/nginx_to_json
moon run examples/syslog_to_json
bash tools/check_no_pii.sh

#Boundaries

#Licence