indy 0.2.0 → 0.3.0

data/History.txt

@@ -1,3 +1,9 @@
+=== 0.3.0 / 2011-08-02
+
+* To search a file, specify a File object as the source.
+  (Support for file paths will be restored in the future.)
+* Use :log_format as the key to specify your custom format and fields (:pattern is deprecated).
+
 === 0.2.0 / 2011-03-08
 
 * Support for Multiline log entries. See README.md

data/README.md

@@ -4,7 +4,7 @@ Indy: A Log Archaeology Tool
 Synopsis
 --------
 
-Log files are often searched for particular strings but it does not often treat the logs themselves as data structures.  Indy attempts to deliver logs with more powerful features by allowing the ability to collect segments of a log from particular time; find a particular event; or monitor/reflect on a log to see if a particular event occurred (or not occurred).
+Log files are often searched for particular strings but are not often treated as data structures.  Indy attempts to deliver log content via more powerful features by allowing the ability to collect segments of a log from particular time; find a particular event; or monitor/reflect on a log to see if a particular event occurred (or not occurred).
 
 Installation
 ------------
@@ -30,7 +30,8 @@ Usage
 
 ### As a file
 
-    Indy.search('logpath/output.log').for(:application => 'MyApp')
+    Indy.search(file_object).for(:application => 'MyApp')
+    Indy.search(:file => file_object).for(:application => 'MyApp')
 
 ### As a string
 
@@ -42,42 +43,47 @@ Usage
 
 ## Log Pattern
 
-### Default Log Pattern
+### Default Log Format
   
-The default search pattern follows this form:  
+The default log format follows this form:
 YYYY-MM-DD HH:MM:SS SEVERITY APPLICATION_NAME - MESSAGE
 
-Which uses this regexp:
+Which uses this Regexp:
     /^(\d{4}.\d{2}.\d{2}\s+\d{2}.\d{2}.\d{2})\s+(TRACE|DEBUG|INFO|WARN|ERROR|FATAL)\s+(\w+)\s+-\s+(.+)$/
 
 and specifies these fields:  
     [:time, :severity, :application, :message]
 
 For example:  
-    Indy.search(source).for(:severity => 'INFO')
-    Indy.search(source).for(:application => 'MyApp', :severity => 'DEBUG')
+    Indy.search(log_file).for(:severity => 'INFO')
+    Indy.search(log_file).for(:application => 'MyApp', :severity => 'DEBUG')
 
-### Custom Log Pattern
+### Custom Log Format
 
-If the default pattern is obviously not strong enough for you, brew your own.
-To do so, specify a pattern and each of the match with their symbolic name.
+If you have a different log format you can brew your own.
+To do so, specify a Regexp pattern that captures each field you want to reference.
+Include it as the first item of your log format array, followed by a list of symbols that name the captured fields.
 
+    # If your log format is:
     # HH:MM:SS SEVERITY APPLICATION#METHOD - MESSAGE
-    custom_pattern = /^(\d{2}:\d{2}:\d{2})\s*(INFO|DEBUG|WARN|ERROR)\s*([^#]+)#([^\s]+)\s*-\s*(.+)$/
-
-    Indy.search(source).with(custom_pattern,:time,:severity,:application,:method,:message).for(:severity => 'INFO', :method => 'allocate')
+    # Build an appropriate regexp
+    custom_regexp = /^(\d{2}:\d{2}:\d{2})\s*(INFO|DEBUG|WARN|ERROR)\s*([^#]+)#([^\s]+)\s*-\s*(.+)$/
+    # Combine the pattern and the list of fields
+    custom_log_format = [custom_regexp,:time,:severity,:application,:method,:message]
+    # Use Indy#with to define your format
+    Indy.search(source).with(custom_log_format).for(:severity => 'INFO', :method => 'allocate')
 
-### Predefined Log Patterns
+### Predefined Log Format
 
-Several log formats have been predefined for ease of configuration. See indy/patterns.rb
+Several log formats have been predefined for ease of configuration. See indy/formats.rb
 
-    # Indy::COMMON_LOG_PATTERN
-    # Indy::COMBINED_LOG_PATTERN
-    # Indy::LOG4R_DEFAULT_PATTERN
+    # Indy::COMMON_LOG_FORMAT
+    # Indy::COMBINED_LOG_FORMAT
+    # Indy::LOG4R_DEFAULT_FORMAT
     #
     # Example (Log4r)
     #  INFO mylog: This is a message with level INFO
-    Indy.new(:source => 'logfile.txt', :pattern => Indy::LOG4R_DEFAULT_PATTERN).for(:application => 'mylog')
+    Indy.new(:source => log_file, :log_format => Indy::LOG4R_DEFAULT_FORMAT).for(:application => 'mylog')
 
 ### Multiline log entries
 
@@ -97,9 +103,10 @@ Example:
 
     # Given this log containing two entries:
     #
-    # INFO MyApp - Multiline message begins here
+    # INFO MyApp - Multiline message begins here...
     # and ends here
-    # DEBUG MyOtherApp - Single line message
+    # DEBUG MyOtherApp - Single line message.
+    # WARN MyOtherApp - Another single line message.
     
     severity_string = 'DEBUG|INFO|WARN|ERROR|FATAL'
 
@@ -107,7 +114,7 @@ Example:
     #                  /^(#{severity_string}) (\w+) - (.*)$/
     multiline_regexp = /^(#{severity_string}) (\w+) - (.*?)(?=^#{severity_string}|\z)/
 
-    Indy.new( :multiline => true, :pattern => [multiline_regexp, :severity, :application, :message], :source => MY_LOG)
+    Indy.new( :multiline => true, :log_format => [multiline_regexp, :severity, :application, :message], :source => MY_LOG)
 
 ### Explicit Time Format
 

data/Rakefile

@@ -1,10 +1,10 @@
 require 'rake'
 require 'rspec/core'
 require 'rspec/core/rake_task'
-require 'rcov/rcovtask'
 require "cucumber/rake/task"
 require "yard"
 
+
 desc 'Default: run tests'
 task :default => :test
 
@@ -25,12 +25,10 @@ Cucumber::Rake::Task.new(:features) do |task|
   task.cucumber_opts = ["features", "-f progress"]
 end
 
-desc "Run all reports, specs and features"
+desc "Run perf, flog, specs and features"
 task :all do
   puts "\nProfiling report"
   Rake::Task['perf'].invoke
-  puts "\nCode Coverage report"
-  Rake::Task['coverage'].invoke
   puts "\nFlog results"
   Rake::Task['flog'].invoke
   puts "\nSpec Tests"
@@ -45,6 +43,7 @@ task :test do
   Rake::Task['features'].invoke
 end
 
+
 desc "Flog the code! (*nix only)"
 task :flog do
   system('find lib -name \*.rb | xargs flog')
@@ -55,16 +54,11 @@ task :flog_detail do
   system('find lib -name \*.rb | xargs flog -d')
 end
 
-# Task :rcov -- Run RCOV to Generate code coverage report
-Rcov::RcovTask.new do |t|
-  t.libs << "lib"
-  t.test_files = FileList['spec/*.rb']
-  t.rcov_opts = ['--exclude', 'spec', '--exclude', 'gems', '-T']
-  t.verbose = true
-end
 
 # Task :yard -- Generate yard + yard-cucumber docs
 YARD::Rake::YardocTask.new do |t|
   t.files   = ['features/**/*', 'lib/**/*.rb']
   t.options = ['--private']
-end
+end
+
+puts "\nTo create a report in /coverage, execute:\nCOVERAGE=true rake test\n\n"

data/features/file.feature

@@ -2,7 +2,7 @@
 Feature: Finding log entries in a file
 
   Background:
-    Given the following log:
+    Given the following log file:
     """
     spec/data.log
     """

data/features/step_definitions/find_by.steps.rb

@@ -29,18 +29,6 @@ When /^searching the log for the exact match of custom field ([^"]+)\s*"([^"]+)"
   @results = @indy.for(field.strip.gsub(/\s/,'_').to_sym => value)
 end
 
-When /^searching the log for entries in the (\w+ \w+), by (.+)$/ do |portion, method|
-  method = method.intern
-  case portion
-  when /(second|last) half/
-    @results = @indy.last(:half, method)
-  when 'first half'
-    @results = @indy.first(:half, method)
-  else
-    pending
-  end
-end
-
 Then /^I expect the (first|last|\d+(?:st|nd|rd|th)) entry to be:$/ do |position,expected|
   @results[position].line.should == expected
 end

data/features/step_definitions/log_file.steps.rb

@@ -1,4 +1,8 @@
 
+Given /^the following log file:$/ do |string|
+  @indy = Indy.search(File.open(string, 'r'))
+end
+
 Given /^the following log:$/ do |string|
   @indy = Indy.search(string)
 end

data/features/step_definitions/support/env.rb

@@ -1 +1,5 @@
+require 'simplecov'
+SimpleCov.start if ENV["COVERAGE"]
+# SimpleCov.root("#{File.dirname(__FILE__)}/../../../..")
+
 require "#{File.dirname(__FILE__)}/../../../lib/indy"

data/features/step_definitions/support/transforms.rb

@@ -18,10 +18,6 @@ Transform /^last$/ do |order|
   -1
 end
 
-Transform /^(\d+)(?:st|nd|rd|th)$/ do |order|
-  order.to_i - 1
-end
-
 # When searching the log for all entries after and including the time 2000-09-07 14:07:44
 Transform /^ and including$/ do |inclusive|
   true

data/indy.gemspec

@@ -41,12 +41,13 @@ Gem::Specification.new do |s|
   s.add_dependency('activesupport', '>= 2.3.5')
 
   s.add_development_dependency('cucumber', '>= 0.10.0')
-  s.add_development_dependency('yard', '>= 0.6.4')
+  s.add_development_dependency('yard', '>= 0.7.2')
   s.add_development_dependency('yard-cucumber', '>= 2.0.0')
   s.add_development_dependency('rspec', '>= 2.4.0')
   s.add_development_dependency('rspec-mocks', '>= 2.4.0')
   s.add_development_dependency('rspec-prof', '>= 0.0.3')
-  s.add_development_dependency('rcov', '>= 0.9.9')
+  s.add_development_dependency('simplecov', '>= 0.4.0')
+  s.add_development_dependency('ruby-debug19', '>= 0.11.0')
   s.add_development_dependency('flog', '>= 2.5.0')
 
   changes = Indy.show_version_changes(::Indy::VERSION)

data/lib/indy.rb

@@ -1,7 +1,10 @@
-$:.unshift(File.dirname(__FILE__)) unless
-  $:.include?(File.dirname(__FILE__)) || $:.include?(File.expand_path(File.dirname(__FILE__)))
-
-require 'indy/indy'
-require 'indy/result_set'
-require 'indy/log_formats'
-require 'indy/patterns'
+require 'simplecov'
+SimpleCov.start if ENV["COVERAGE"]
+
+$:.unshift(File.dirname(__FILE__)) unless
+  $:.include?(File.dirname(__FILE__)) || $:.include?(File.expand_path(File.dirname(__FILE__)))
+
+require 'indy/source'
+require 'indy/indy'
+require 'indy/result_set'
+require 'indy/log_formats'

data/lib/indy/formats.rb

@@ -0,0 +1,3 @@
+class Indy
+
+end

data/lib/indy/indy.rb

@@ -2,58 +2,59 @@ require 'active_support/core_ext'
 
 class Indy
 
-  class InvalidSource < Exception; end
+  def self.suppress_warnings(&block)
+    verbose = $VERBOSE
+    $VERBOSE = nil
+    yield block
+    $VERBOSE = verbose
+  end
 
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 
-  #
   # hash with one key (:string, :file, or :cmd) set to the string that defines the log
-  #
   attr_accessor :source
 
-  #
   # array with regexp string and capture groups followed by log field
   # name symbols. :time field is required to use time scoping
-  #
-  attr_accessor :pattern
+  attr_accessor :log_format
 
-  #
   # format string for explicit date/time format (optional)
-  #
   attr_accessor :time_format
 
-  #
-  # initialization flag required if multiline log entries are allowed
-  #
-  # @example
-  #
-  #  Indy.new(:source => MY_LOG, :pattern => [MY_REGEXP, FIELD1, FIELD2, FIELD3], :multiline => true)
-  #
+  # initialization flag (true || nil) to enable multiline log entries. See README
   attr_accessor :multiline
 
   #
-  # Initialize Indy.
+  # Initialize Indy. Also see class method Indy.search()
   #
   # @example
   #
-  #  Indy.new(:source => LOG_FILENAME)
+  #  Indy.new(:source => LOG_FILE)
   #  Indy.new(:source => LOG_CONTENTS_STRING)
   #  Indy.new(:source => {:cmd => LOG_COMMAND_STRING})
-  #  Indy.new(:pattern => [LOG_REGEX_PATTERN,:time,:application,:message],:source => LOG_FILENAME)
-  #  Indy.new(:time_format => '%m-%d-%Y',:pattern => [LOG_REGEX_PATTERN,:time,:application,:message],:source => LOG_FILENAME)
+  #  Indy.new(:log_format => [LOG_REGEX_PATTERN,:time,:application,:message],:source => LOG_FILE)
+  #  Indy.new(:time_format => '%m-%d-%Y',:pattern => [LOG_REGEX_PATTERN,:time,:application,:message],:source => LOG_FILE)
   #
   def initialize(args)
-    @source = @pattern = @time_format = @log_regexp = @log_fields = @multiline = nil
-    @source = Hash.new
+    @source = @log_format = @time_format = @log_regexp = @log_fields = @multiline = nil
 
     while (arg = args.shift) do
       send("#{arg.first}=",arg.last)
     end
 
-    update_log_pattern( @pattern )
+    update_log_format( @log_format )
 
   end
 
+  #
+  # Create an Indy::Source object to manage the log source
+  #
+  # @param [String,Hash] source A filename, or log content as a string. Use a Hash with :cmd key to specify a command string.
+  #
+  def source=(param)
+    @source = Source.new(param)
+  end
+
   class << self
 
     #
@@ -66,38 +67,45 @@ class Indy
     #   Alternately, a Hash with a :source key (amoung others) can be used to
     #   provide multiple initialization parameters.
     #
-    # @example
+    # @example filename source
     #   Indy.search("apache.log").for(:severity => "INFO")
     #   
-    # @example
+    # @example string source
     #   Indy.search("INFO 2000-09-07 MyApp - Entering APPLICATION.\nINFO 2000-09-07 MyApp - Entering APPLICATION.").for(:all)
     #
-    # @example
+    # @example command source
     #   Indy.search(:cmd => "cat apache.log").for(:severity => "INFO")
     #
-    # @example
-    #   Indy.search(:source => {:cmd => "cat apache.log"}, :pattern => LOG_PATTERN, :time_format => MY_TIME_FORMAT).for(:all)
+    # @example source as well as other paramters
+    #   Indy.search(:source => {:cmd => "cat apache.log"}, :log_format => LOG_FORMAT, :time_format => MY_TIME_FORMAT).for(:all)
     #
     def search(params=nil)
   
-      raise Indy::InvalidSource if params.nil? || params.is_a?(Fixnum)
-
       if params.respond_to?(:keys) && params[:source]
         Indy.new(params)
       else
-        Indy.new(:source => params, :pattern => DEFAULT_LOG_PATTERN)
+        Indy.new(:source => params, :log_format => DEFAULT_LOG_FORMAT)
       end
     end
 
-  end
+    #
+    # Return a Struct::Line object from a hash of values from a log entry
+    #
+    # @param [Hash] line_hash a hash of :field_name => value pairs for one log line
+    #
+    def create_struct( line_hash )
+      params = line_hash.keys.sort_by{|e|e.to_s}.collect {|k| line_hash[k]}
+      Struct::Line.new( *params )
+    end
 
+  end
 
 
   #
-  # Specify the log pattern to use as the comparison against each line within
+  # Specify the log format to use as the comparison against each line within
   # the log file that has been specified.
   #
-  # @param [Array] pattern_array an Array with the regular expression as the first element
+  # @param [Array] log_format an Array with the regular expression as the first element
   #        followed by list of fields (Symbols) in the log entry
   #        to use for comparison against each log line.
   #
@@ -105,8 +113,8 @@ class Indy
   #
   #  Indy.search(LOG_FILE).with(/^(\d{2}.\d{2}.\d{2})\s*(.+)$/,:time,:message)
   #
-  def with(pattern_array = :default)
-    update_log_pattern( pattern_array )
+  def with(log_format = :default)
+    update_log_format( log_format )
     self
   end
   
@@ -119,18 +127,23 @@ class Indy
   #
   def for(search_criteria)
     results = ResultSet.new
-
     case search_criteria
     when Enumerable
       results += _search do |result|
-        create_struct(result) if search_criteria.reject {|criteria,value| result[criteria] == value }.empty?
+        result_struct = Indy.create_struct(result) if search_criteria.reject {|criteria,value| result[criteria] == value }.empty?
+        yield result_struct if block_given? and result_struct
+        result_struct
       end
 
     when :all
-      results += _search {|result| create_struct(result) }
+      results += _search do |result|
+        result_struct = Indy.create_struct(result)
+        yield result_struct if block_given?
+        result_struct
+      end
     end
 
-    results
+    results.compact
   end
 
 
@@ -142,23 +155,25 @@ class Indy
   #
   # @example For all applications that end with Service
   #
-  #  Indy.search(LOG_FILE).like(:application => '(.+)Service')
+  #  Indy.search(LOG_FILE).like(:application => '.+service')
   #
   def like(search_criteria)
     results = ResultSet.new
 
     results += _search do |result|
-      create_struct(result) if search_criteria.reject {|criteria,value| result[criteria] =~ /#{value}/ }.empty?
+      result_struct = Indy.create_struct(result) if search_criteria.reject {|criteria,value| result[criteria] =~ /#{value}/i }.empty?
+      yield result_struct if block_given? and result_struct
+      result_struct
     end
 
-    results
+    results.compact
   end
 
   alias_method :matching, :like
 
 
   #
-  # Last() scopes the eventual search to the last N minutes worth of entries.
+  # Scopes the eventual search to the last N entries, or last N minutes of entries.
   #
   # @param [Hash] scope_criteria hash describing the amount of time at
   # the last portion of the source
@@ -185,47 +200,9 @@ class Indy
     self
   end
 
-  #
-  # Return a Struct::Line for the last valid entry from the source
-  #
-  def last_entry
-    last_entries(1)
-  end
 
   #
-  # Return an array of Struct::Line entries for the last N valid entries from the source
-  #
-  # @param [Fixnum] num the number of rows to retrieve
-  #
-  def last_entries(num)
-
-    num_entries = 0
-    result = []
-
-    source_io = open_source
-    source_io.reverse_each do |line|
-
-      hash = parse_line(line)
-
-      set_time(hash) if @time_field
-      
-      if hash
-        num_entries += 1
-        result << hash
-        break if num_entries >= num
-      end
-    end
-
-    warn "No matching lines found in source: #{source_io.class}" if result.empty?
-
-    source_io.close if @source[:file] || @source[:cmd]
-
-    num == 1 ? create_struct(result.first) : result.collect{|e| create_struct(e)}
-  end
-
-
-  #
-  # After() scopes the eventual search to all entries after to this point.
+  # Scopes the eventual search to all entries after to this point.
   #
   # @param [Hash] scope_criteria the field to scope for as the key and the
   #        value to compare against the other log messages
@@ -251,15 +228,15 @@ class Indy
   end
 
   #
-  # reset_time_scope removes any existing start and end times from the instance
-  # Otherwise consecutive calls retain state
+  # Removes any existing start and end times from the instance
+  # Otherwise consecutive search calls retain time scope state
   #
   def reset_scope
     @inclusive = @start_time = @end_time = nil
   end
     
   #
-  # Before() scopes the eventual search to all entries prior to this point.
+  # Scopes the eventual search to all entries prior to this point.
   #
   # @param [Hash] scope_criteria the field to scope for as the key and the
   #        value to compare against the other log messages
@@ -301,7 +278,7 @@ class Indy
 
 
   #
-  # Within() scopes the eventual search to all entries between two points.
+  # Scopes the eventual search to all entries between two times.
   #
   # @param [Hash] scope_criteria the field to scope for as the key and the
   #        value to compare against the other log messages
@@ -323,32 +300,6 @@ class Indy
 
   private
 
-  #
-  # Sets the source for the Indy instance.
-  #
-  # @param [String,Hash] source A filename, or log content as a string. Use a Hash with :cmd key to specify a command string.
-  #
-  # @example
-  #
-  #   source("apache.log")
-  #   source(:cmd => "cat apache.log")
-  #   source("INFO 2000-09-07 MyApp - Entering APPLICATION.\nINFO 2000-09-07 MyApp - Entering APPLICATION.")
-  #
-  def source=(param)
-
-    raise Indy::InvalidSource if param.nil?
-
-    cmd = param[:cmd] rescue nil
-    @source[:cmd] = param[:cmd] if cmd
-
-    unless cmd
-      File.exist?(param) ? @source[:file] = param : @source[:string] = param
-    end
-
-    raise Indy::InvalidSource unless @source.values.reject {|value| value.kind_of? String }.empty?
-
-  end
-
   #
   # Set @pattern as well as @log_regexp, @log_fields, and @time_field
   #
@@ -356,16 +307,16 @@ class Indy
   #        followed by list of fields (Symbols) in the log entry
   #        to use for comparison against each log line.
   #
-  def update_log_pattern( pattern_array )
+  def update_log_format( log_format )
 
-    case pattern_array
+    case log_format
     when :default, nil
-      @pattern = DEFAULT_LOG_PATTERN
+      @log_format = DEFAULT_LOG_FORMAT
     else
-      @pattern = pattern_array
+      @log_format = log_format
     end
 
-    @log_regexp, *@log_fields = @pattern
+    @log_regexp, *@log_fields = @log_format
 
     @time_field = ( @log_fields.include?(:time) ? :time : nil )
 
@@ -385,7 +336,7 @@ class Indy
     line_matched = nil
     time_search = use_time_criteria?
 
-    source_io = open_source
+    source_io = @source.open(time_search)
 
     if @multiline
       results = source_io.read.scan(Regexp.new(@log_regexp, Regexp::MULTILINE)).collect do |entry|
@@ -420,42 +371,11 @@ class Indy
 
     end
 
-    warn "No matching lines found in source: #{source_io.class}" unless line_matched
+#    warn "No matching lines found in source: #{source_io.class}" unless line_matched
 
-    source_io.close if @source[:file] || @source[:cmd]    
     results.compact
   end
 
-
-  #
-  # Return a log io object
-  #
-  def open_source
-    begin
-
-      case @source.keys.first # and only
-      when :cmd
-        source_io = exec_command(@source[:cmd])
-        raise "Failed to execute command (#{@source[:cmd]})" if source_io.nil?
-
-      when :file
-        source_io = File.open(@source[:file], 'r')
-        raise "Filed to open file: #{@source[:file]}" if source_io.nil?
-
-      when :string
-        source_io = StringIO.new( @source[:string] )
-
-      else
-        raise "Unsupported log source: #{@source.inspect}"
-      end
-
-    rescue Exception => e
-      raise "Unable to open log source. (#{e.message})"
-    end
-
-    source_io
-  end
-
   #
   # Return a hash of field=>value pairs for the log line
   #
@@ -466,7 +386,8 @@ class Indy
   def parse_line( line )
 
     if line.kind_of? String
-      match_data = /#{@log_regexp}/.match(line)
+      match_data = nil
+      Indy.suppress_warnings { match_data = /#{@log_regexp}/.match(line) }
       return nil unless match_data
 
       values = match_data.captures
@@ -483,7 +404,6 @@ class Indy
     hash = Hash[ *@log_fields.zip( values ).flatten ]
     hash[:line] = entire_line.strip
 
-
     hash
   end
 
@@ -557,19 +477,22 @@ class Indy
   end
 
   #
-  # Try opening the string as a command string, returning an IO object
-  #
-  # @param [String] command_string string of command that will return log contents
+  # Return a time or datetime object way in the future
   #
-  def exec_command(command_string)
+  def forever
+    @time_format ? DateTime.new(4712) : Time.at(0x7FFFFFFF)
+  end
 
+  #
+  # Return a time or datetime object way in the past
+  #
+  def forever_ago
     begin
-      io = IO.popen(command_string)
-      return nil if io.eof?
+      @time_format ? DateTime.new(-4712) : Time.at(-0x7FFFFFFF)
     rescue
-      nil
+      # Windows Ruby Time can't handle dates prior to 1969
+      @time_format ? DateTime.new(-4712) : Time.at(0)
     end
-    io
   end
 
   #
@@ -577,44 +500,44 @@ class Indy
   #
   def define_struct
     fields = (@log_fields + [:_time, :line]).sort_by{|e|e.to_s}
-
-    # suppress Struct 'redefining constant' warning
-    verbose = $VERBOSE
-    $VERBOSE = nil
-
-    Struct.new( "Line", *fields )
-
-    $VERBOSE = verbose
+    Indy.suppress_warnings { Struct.new( "Line", *fields ) }
   end
 
   #
-  # Return a Struct::Line object populated with the values from the line_hash
-  #
-  # @param [Hash] line_hash a hash of :field_name => value pairs for one log line
+  # Return a Struct::Line for the last valid entry from the source
   #
-  def create_struct( line_hash )
-    params = line_hash.keys.sort_by{|e|e.to_s}.collect {|k| line_hash[k]}
-    Struct::Line.new( *params )
+  def last_entry
+    last_entries(1)
   end
 
   #
-  # Return a time or datetime object way in the future
-  #
-  def forever
-    @time_format ? DateTime.new(4712) : Time.at(0x7FFFFFFF)
-  end
-
+  # Return an array of Struct::Line entries for the last N valid entries from the source
   #
-  # Return a time or datetime object way in the past
+  # @param [Fixnum] num the number of rows to retrieve
   #
-  def forever_ago
-    begin
-      @time_format ? DateTime.new(-4712) : Time.at(-0x7FFFFFFF)
-    rescue
-      # Windows Ruby Time can't handle dates prior to 1969
-      @time_format ? DateTime.new(-4712) : Time.at(0)
+  def last_entries(num)
+
+    num_entries = 0
+    result = []
+
+    source_io = @source.open
+
+    source_io.reverse_each do |line|
+
+      hash = parse_line(line)
+
+      set_time(hash) if @time_field
+
+      if hash
+        num_entries += 1
+        result << hash
+        break if num_entries >= num
+      end
     end
-  end
 
+    warn "#last_entries found no matching lines in source." if result.empty?
+
+    num == 1 ? Indy.create_struct(result.first) : result.collect{|e| Indy.create_struct(e)}
+  end
 
 end