Phase 1: Windows log collection + full-text search

Extends the agent, ingest, storage, api, and web with Windows Event
Log/ETW sourcing and Tantivy-backed free-text search, per the approved
Phase 1 plan.

- CLAUDE.md: materialized on disk (never existed as a file before) with
  a new Phase 1 "done looks like" section.
- agent: Windows Event Log (EvtSubscribe) and ETW sources, Windows
  service wrapper (install/uninstall/run-service), both feature- and
  target_os-gated so Linux builds/tests/clippy stay unaffected. Also
  fixed two pre-existing Phase 0 clippy gaps (dead-code on
  default-features-only builds, a type-inference edge case) found while
  testing every feature combination properly for the first time.
  UNVERIFIED on real Windows -- no Windows toolchain existed anywhere in
  the build environment; flagged prominently in three places.
- proto/ingest: new record_id field, assigned once server-side in
  ingest's gRPC front end so ClickHouse and Tantivy agree on the same ID
  for the same record.
- storage: record_id column + bloom filter index, verified against a
  live ClickHouse.
- search: new service, Tantivy index, rskafka consumer as an independent
  second consumer group on the same Redpanda topic ingest already reads.
- api/web: new /search endpoint and page, sharing the query page's
  result-table shape and component.
- hack/windows-fixture: sends realistic Windows-shaped data straight to
  ingest, so the pipeline's handling of it is verifiable without a
  Windows host.

Verified end-to-end on the live docker-compose stack: the same record_id
comes back from both /query and /search for the same log line, including
for windows-fixture's synthetic Windows Event Log data. Real bugs found
and fixed along the way: api/Dockerfile missing proto/ in its build
context, search's logs being completely silent (RUST_LOG gap), and
search/target/ missing from .gitignore/.dockerignore.
This commit is contained in:
2026-08-13 11:27:35 -07:00
parent fe854b1091
commit cd8aa290ca
66 changed files with 6084 additions and 171 deletions
+59
View File
@@ -0,0 +1,59 @@
<script lang="ts">
// Shared between the SQL query page and the free-text search page —
// both /api endpoints return the same {columns, rows} shape
// specifically so this component didn't need to exist twice.
let {
columns,
rows,
hasRun = false
}: { columns: string[]; rows: unknown[][]; hasRun?: boolean } = $props();
function formatCell(value: unknown): string {
if (value === null || value === undefined) return '';
if (typeof value === 'object') return JSON.stringify(value);
return String(value);
}
</script>
{#if hasRun}
<p>{rows.length} row(s)</p>
{/if}
{#if columns.length > 0}
<table>
<thead>
<tr>
{#each columns as col (col)}
<th>{col}</th>
{/each}
</tr>
</thead>
<tbody>
{#each rows as row, i (i)}
<tr>
{#each row as cell, j (j)}
<td>{formatCell(cell)}</td>
{/each}
</tr>
{/each}
</tbody>
</table>
{/if}
<style>
table {
border-collapse: collapse;
width: 100%;
margin-top: 1rem;
}
th,
td {
border: 1px solid #ccc;
padding: 0.25rem 0.5rem;
text-align: left;
font-size: 0.85rem;
}
th {
background: #f0f0f0;
}
</style>
+29
View File
@@ -1,5 +1,6 @@
<script lang="ts">
import favicon from '$lib/assets/favicon.svg';
import { page } from '$app/state';
let { children } = $props();
</script>
@@ -9,4 +10,32 @@
<link rel="icon" href={favicon} />
</svelte:head>
<nav>
<a href="/" class:active={page.url.pathname === '/'}>SQL Query</a>
<a href="/search" class:active={page.url.pathname === '/search'}>Full-Text Search</a>
</nav>
{@render children()}
<style>
nav {
font-family: system-ui, sans-serif;
max-width: 960px;
margin: 1rem auto 0;
padding: 0 1rem;
display: flex;
gap: 1rem;
border-bottom: 1px solid #ccc;
}
nav a {
padding: 0.5rem 0;
text-decoration: none;
color: #555;
border-bottom: 2px solid transparent;
}
nav a.active {
color: #000;
border-bottom-color: #000;
font-weight: 600;
}
</style>
+6 -47
View File
@@ -4,6 +4,8 @@
// This is a placeholder for the real query UI that lands once /api grows
// a real SPL-like query layer in Phase 2.
import ResultsTable from '$lib/ResultsTable.svelte';
const apiBase = import.meta.env.VITE_API_BASE_URL ?? 'http://localhost:8080';
let sql = $state('SELECT * FROM logs ORDER BY timestamp DESC LIMIT 100');
@@ -13,12 +15,6 @@
let loading = $state(false);
let hasRun = $state(false);
function formatCell(value: unknown): string {
if (value === null || value === undefined) return '';
if (typeof value === 'object') return JSON.stringify(value);
return String(value);
}
async function runQuery() {
loading = true;
error = '';
@@ -49,10 +45,11 @@
</script>
<main>
<h1>Sentry — Log Query (Phase 0)</h1>
<h1>Sentry — Log Query</h1>
<p>
Raw SQL only, SELECT statements against the <code>logs</code> table. No auth, no query
builder yet — see <code>/api</code> for what's actually allowed.
builder yet — see <code>/api</code> for what's actually allowed. Looking for free-text
search instead? See the <a href="/search">Full-Text Search</a> page.
</p>
<textarea bind:value={sql} rows="4" cols="100" spellcheck="false"></textarea>
@@ -66,30 +63,7 @@
<p class="error">Error: {error}</p>
{/if}
{#if hasRun && !error}
<p>{rows.length} row(s)</p>
{/if}
{#if columns.length > 0}
<table>
<thead>
<tr>
{#each columns as col (col)}
<th>{col}</th>
{/each}
</tr>
</thead>
<tbody>
{#each rows as row, i (i)}
<tr>
{#each row as cell, j (j)}
<td>{formatCell(cell)}</td>
{/each}
</tr>
{/each}
</tbody>
</table>
{/if}
<ResultsTable {columns} {rows} {hasRun} />
</main>
<style>
@@ -110,19 +84,4 @@
.error {
color: #b00020;
}
table {
border-collapse: collapse;
width: 100%;
margin-top: 1rem;
}
th,
td {
border: 1px solid #ccc;
padding: 0.25rem 0.5rem;
text-align: left;
font-size: 0.85rem;
}
th {
background: #f0f0f0;
}
</style>
+96
View File
@@ -0,0 +1,96 @@
<script lang="ts">
// Phase 1: free-text search via POST /search on the api service, hits
// the Tantivy-backed search service and returns full rows joined back
// against ClickHouse. No unified query experience with the SQL page —
// that's Phase 2's job.
import ResultsTable from '$lib/ResultsTable.svelte';
const apiBase = import.meta.env.VITE_API_BASE_URL ?? 'http://localhost:8080';
let query = $state('');
let columns = $state<string[]>([]);
let rows = $state<unknown[][]>([]);
let error = $state('');
let loading = $state(false);
let hasRun = $state(false);
async function runSearch() {
loading = true;
error = '';
try {
const res = await fetch(`${apiBase}/search`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ query })
});
const body = await res.json();
if (!res.ok) {
error = body?.error ?? `request failed with status ${res.status}`;
columns = [];
rows = [];
return;
}
columns = body.columns ?? [];
rows = body.rows ?? [];
} catch (e) {
error = e instanceof Error ? e.message : String(e);
columns = [];
rows = [];
} finally {
loading = false;
hasRun = true;
}
}
</script>
<main>
<h1>Sentry — Full-Text Search</h1>
<p>
Free-text search over the <code>message</code> field, via Tantivy. Supports plain terms,
<code>"exact phrases"</code>, and <code>wildcard*</code> — see
<code>/search</code> for the full query syntax. Looking for structured/aggregation queries
instead? See the <a href="/">SQL Query</a> page.
</p>
<input
type="text"
bind:value={query}
placeholder="e.g. &quot;connection refused&quot; or timeout*"
spellcheck="false"
onkeydown={(e) => e.key === 'Enter' && runSearch()}
/>
<div>
<button onclick={runSearch} disabled={loading || query.trim() === ''}>
{loading ? 'Searching…' : 'Search'}
</button>
</div>
{#if error}
<p class="error">Error: {error}</p>
{/if}
<ResultsTable {columns} {rows} {hasRun} />
</main>
<style>
main {
font-family: system-ui, sans-serif;
max-width: 960px;
margin: 2rem auto;
padding: 0 1rem;
}
input {
width: 100%;
font-family: monospace;
font-size: 0.9rem;
padding: 0.4rem;
box-sizing: border-box;
}
button {
margin-top: 0.5rem;
}
.error {
color: #b00020;
}
</style>
+4
View File
@@ -0,0 +1,4 @@
// Same reasoning as the root page's +page.ts: no load function (all data
// comes from a client-side fetch on submit), so a plain prerender is
// enough for the static adapter.
export const prerender = true;