Phase 1: Windows log collection + full-text search
Extends the agent, ingest, storage, api, and web with Windows Event Log/ETW sourcing and Tantivy-backed free-text search, per the approved Phase 1 plan. - CLAUDE.md: materialized on disk (never existed as a file before) with a new Phase 1 "done looks like" section. - agent: Windows Event Log (EvtSubscribe) and ETW sources, Windows service wrapper (install/uninstall/run-service), both feature- and target_os-gated so Linux builds/tests/clippy stay unaffected. Also fixed two pre-existing Phase 0 clippy gaps (dead-code on default-features-only builds, a type-inference edge case) found while testing every feature combination properly for the first time. UNVERIFIED on real Windows -- no Windows toolchain existed anywhere in the build environment; flagged prominently in three places. - proto/ingest: new record_id field, assigned once server-side in ingest's gRPC front end so ClickHouse and Tantivy agree on the same ID for the same record. - storage: record_id column + bloom filter index, verified against a live ClickHouse. - search: new service, Tantivy index, rskafka consumer as an independent second consumer group on the same Redpanda topic ingest already reads. - api/web: new /search endpoint and page, sharing the query page's result-table shape and component. - hack/windows-fixture: sends realistic Windows-shaped data straight to ingest, so the pipeline's handling of it is verifiable without a Windows host. Verified end-to-end on the live docker-compose stack: the same record_id comes back from both /query and /search for the same log line, including for windows-fixture's synthetic Windows Event Log data. Real bugs found and fixed along the way: api/Dockerfile missing proto/ in its build context, search's logs being completely silent (RUST_LOG gap), and search/target/ missing from .gitignore/.dockerignore.
This commit is contained in:
@@ -0,0 +1,59 @@
|
||||
<script lang="ts">
|
||||
// Shared between the SQL query page and the free-text search page —
|
||||
// both /api endpoints return the same {columns, rows} shape
|
||||
// specifically so this component didn't need to exist twice.
|
||||
let {
|
||||
columns,
|
||||
rows,
|
||||
hasRun = false
|
||||
}: { columns: string[]; rows: unknown[][]; hasRun?: boolean } = $props();
|
||||
|
||||
function formatCell(value: unknown): string {
|
||||
if (value === null || value === undefined) return '';
|
||||
if (typeof value === 'object') return JSON.stringify(value);
|
||||
return String(value);
|
||||
}
|
||||
</script>
|
||||
|
||||
{#if hasRun}
|
||||
<p>{rows.length} row(s)</p>
|
||||
{/if}
|
||||
|
||||
{#if columns.length > 0}
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
{#each columns as col (col)}
|
||||
<th>{col}</th>
|
||||
{/each}
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each rows as row, i (i)}
|
||||
<tr>
|
||||
{#each row as cell, j (j)}
|
||||
<td>{formatCell(cell)}</td>
|
||||
{/each}
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
{/if}
|
||||
|
||||
<style>
|
||||
table {
|
||||
border-collapse: collapse;
|
||||
width: 100%;
|
||||
margin-top: 1rem;
|
||||
}
|
||||
th,
|
||||
td {
|
||||
border: 1px solid #ccc;
|
||||
padding: 0.25rem 0.5rem;
|
||||
text-align: left;
|
||||
font-size: 0.85rem;
|
||||
}
|
||||
th {
|
||||
background: #f0f0f0;
|
||||
}
|
||||
</style>
|
||||
@@ -1,5 +1,6 @@
|
||||
<script lang="ts">
|
||||
import favicon from '$lib/assets/favicon.svg';
|
||||
import { page } from '$app/state';
|
||||
|
||||
let { children } = $props();
|
||||
</script>
|
||||
@@ -9,4 +10,32 @@
|
||||
<link rel="icon" href={favicon} />
|
||||
</svelte:head>
|
||||
|
||||
<nav>
|
||||
<a href="/" class:active={page.url.pathname === '/'}>SQL Query</a>
|
||||
<a href="/search" class:active={page.url.pathname === '/search'}>Full-Text Search</a>
|
||||
</nav>
|
||||
|
||||
{@render children()}
|
||||
|
||||
<style>
|
||||
nav {
|
||||
font-family: system-ui, sans-serif;
|
||||
max-width: 960px;
|
||||
margin: 1rem auto 0;
|
||||
padding: 0 1rem;
|
||||
display: flex;
|
||||
gap: 1rem;
|
||||
border-bottom: 1px solid #ccc;
|
||||
}
|
||||
nav a {
|
||||
padding: 0.5rem 0;
|
||||
text-decoration: none;
|
||||
color: #555;
|
||||
border-bottom: 2px solid transparent;
|
||||
}
|
||||
nav a.active {
|
||||
color: #000;
|
||||
border-bottom-color: #000;
|
||||
font-weight: 600;
|
||||
}
|
||||
</style>
|
||||
|
||||
@@ -4,6 +4,8 @@
|
||||
// This is a placeholder for the real query UI that lands once /api grows
|
||||
// a real SPL-like query layer in Phase 2.
|
||||
|
||||
import ResultsTable from '$lib/ResultsTable.svelte';
|
||||
|
||||
const apiBase = import.meta.env.VITE_API_BASE_URL ?? 'http://localhost:8080';
|
||||
|
||||
let sql = $state('SELECT * FROM logs ORDER BY timestamp DESC LIMIT 100');
|
||||
@@ -13,12 +15,6 @@
|
||||
let loading = $state(false);
|
||||
let hasRun = $state(false);
|
||||
|
||||
function formatCell(value: unknown): string {
|
||||
if (value === null || value === undefined) return '';
|
||||
if (typeof value === 'object') return JSON.stringify(value);
|
||||
return String(value);
|
||||
}
|
||||
|
||||
async function runQuery() {
|
||||
loading = true;
|
||||
error = '';
|
||||
@@ -49,10 +45,11 @@
|
||||
</script>
|
||||
|
||||
<main>
|
||||
<h1>Sentry — Log Query (Phase 0)</h1>
|
||||
<h1>Sentry — Log Query</h1>
|
||||
<p>
|
||||
Raw SQL only, SELECT statements against the <code>logs</code> table. No auth, no query
|
||||
builder yet — see <code>/api</code> for what's actually allowed.
|
||||
builder yet — see <code>/api</code> for what's actually allowed. Looking for free-text
|
||||
search instead? See the <a href="/search">Full-Text Search</a> page.
|
||||
</p>
|
||||
|
||||
<textarea bind:value={sql} rows="4" cols="100" spellcheck="false"></textarea>
|
||||
@@ -66,30 +63,7 @@
|
||||
<p class="error">Error: {error}</p>
|
||||
{/if}
|
||||
|
||||
{#if hasRun && !error}
|
||||
<p>{rows.length} row(s)</p>
|
||||
{/if}
|
||||
|
||||
{#if columns.length > 0}
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
{#each columns as col (col)}
|
||||
<th>{col}</th>
|
||||
{/each}
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each rows as row, i (i)}
|
||||
<tr>
|
||||
{#each row as cell, j (j)}
|
||||
<td>{formatCell(cell)}</td>
|
||||
{/each}
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
{/if}
|
||||
<ResultsTable {columns} {rows} {hasRun} />
|
||||
</main>
|
||||
|
||||
<style>
|
||||
@@ -110,19 +84,4 @@
|
||||
.error {
|
||||
color: #b00020;
|
||||
}
|
||||
table {
|
||||
border-collapse: collapse;
|
||||
width: 100%;
|
||||
margin-top: 1rem;
|
||||
}
|
||||
th,
|
||||
td {
|
||||
border: 1px solid #ccc;
|
||||
padding: 0.25rem 0.5rem;
|
||||
text-align: left;
|
||||
font-size: 0.85rem;
|
||||
}
|
||||
th {
|
||||
background: #f0f0f0;
|
||||
}
|
||||
</style>
|
||||
|
||||
@@ -0,0 +1,96 @@
|
||||
<script lang="ts">
|
||||
// Phase 1: free-text search via POST /search on the api service, hits
|
||||
// the Tantivy-backed search service and returns full rows joined back
|
||||
// against ClickHouse. No unified query experience with the SQL page —
|
||||
// that's Phase 2's job.
|
||||
|
||||
import ResultsTable from '$lib/ResultsTable.svelte';
|
||||
|
||||
const apiBase = import.meta.env.VITE_API_BASE_URL ?? 'http://localhost:8080';
|
||||
|
||||
let query = $state('');
|
||||
let columns = $state<string[]>([]);
|
||||
let rows = $state<unknown[][]>([]);
|
||||
let error = $state('');
|
||||
let loading = $state(false);
|
||||
let hasRun = $state(false);
|
||||
|
||||
async function runSearch() {
|
||||
loading = true;
|
||||
error = '';
|
||||
try {
|
||||
const res = await fetch(`${apiBase}/search`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ query })
|
||||
});
|
||||
const body = await res.json();
|
||||
if (!res.ok) {
|
||||
error = body?.error ?? `request failed with status ${res.status}`;
|
||||
columns = [];
|
||||
rows = [];
|
||||
return;
|
||||
}
|
||||
columns = body.columns ?? [];
|
||||
rows = body.rows ?? [];
|
||||
} catch (e) {
|
||||
error = e instanceof Error ? e.message : String(e);
|
||||
columns = [];
|
||||
rows = [];
|
||||
} finally {
|
||||
loading = false;
|
||||
hasRun = true;
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<main>
|
||||
<h1>Sentry — Full-Text Search</h1>
|
||||
<p>
|
||||
Free-text search over the <code>message</code> field, via Tantivy. Supports plain terms,
|
||||
<code>"exact phrases"</code>, and <code>wildcard*</code> — see
|
||||
<code>/search</code> for the full query syntax. Looking for structured/aggregation queries
|
||||
instead? See the <a href="/">SQL Query</a> page.
|
||||
</p>
|
||||
|
||||
<input
|
||||
type="text"
|
||||
bind:value={query}
|
||||
placeholder="e.g. "connection refused" or timeout*"
|
||||
spellcheck="false"
|
||||
onkeydown={(e) => e.key === 'Enter' && runSearch()}
|
||||
/>
|
||||
<div>
|
||||
<button onclick={runSearch} disabled={loading || query.trim() === ''}>
|
||||
{loading ? 'Searching…' : 'Search'}
|
||||
</button>
|
||||
</div>
|
||||
|
||||
{#if error}
|
||||
<p class="error">Error: {error}</p>
|
||||
{/if}
|
||||
|
||||
<ResultsTable {columns} {rows} {hasRun} />
|
||||
</main>
|
||||
|
||||
<style>
|
||||
main {
|
||||
font-family: system-ui, sans-serif;
|
||||
max-width: 960px;
|
||||
margin: 2rem auto;
|
||||
padding: 0 1rem;
|
||||
}
|
||||
input {
|
||||
width: 100%;
|
||||
font-family: monospace;
|
||||
font-size: 0.9rem;
|
||||
padding: 0.4rem;
|
||||
box-sizing: border-box;
|
||||
}
|
||||
button {
|
||||
margin-top: 0.5rem;
|
||||
}
|
||||
.error {
|
||||
color: #b00020;
|
||||
}
|
||||
</style>
|
||||
@@ -0,0 +1,4 @@
|
||||
// Same reasoning as the root page's +page.ts: no load function (all data
|
||||
// comes from a client-side fetch on submit), so a plain prerender is
|
||||
// enough for the static adapter.
|
||||
export const prerender = true;
|
||||
Reference in New Issue
Block a user