rails_error_dashboard 0.11.4 → 0.11.6

data/lib/rails_error_dashboard/queries/baseline_stats.rb

@@ -85,23 +85,58 @@ module RailsErrorDashboard
       # @param current_count [Integer] Current error count
       # @param sensitivity [Integer] Standard deviations threshold (default: 2)
       # @return [Hash] { anomaly: true/false, level: Symbol, baseline_type: String }
-      def check_anomaly(current_count, sensitivity: 2)
-        baseline = hourly_baseline || daily_baseline || weekly_baseline
+      # Compare a count against the first available baseline, in matching
+      # units: the current HOUR's count against the hourly baseline, TODAY's
+      # against the daily, THIS WEEK's against the weekly. A bare positional
+      # count is compared against whichever baseline is found (legacy callers).
+      #
+      # @param current_count [Integer, nil] legacy: one count used for any baseline
+      # @param hourly [Integer, nil] events so far this hour
+      # @param daily [Integer, nil] events so far today
+      # @param weekly [Integer, nil] events so far this week
+      def check_anomaly(current_count = nil, sensitivity: 2, hourly: nil, daily: nil, weekly: nil)
+        candidates = [
+          [ hourly_baseline, hourly || current_count ],
+          [ daily_baseline, daily || current_count ],
+          [ weekly_baseline, weekly || current_count ]
+        ]
+        baseline, count = candidates.find { |b, c| b && c }
 
         if baseline.nil?
           return { anomaly: false, level: nil, baseline_type: nil, message: "No baseline available" }
         end
 
-        level = baseline.anomaly_level(current_count, sensitivity: sensitivity)
+        level = baseline.anomaly_level(count, sensitivity: sensitivity)
 
         {
           anomaly: level.present?,
           level: level,
           baseline_type: baseline.baseline_type,
+          current_count: count,
           threshold: baseline.threshold(sensitivity: sensitivity),
-          std_devs_above: baseline.std_devs_above_mean(current_count)
+          std_devs_above: baseline.std_devs_above_mean(count)
         }
       end
+
+      # Events so far in the current hour / day / week, counted in the same
+      # units the baselines were built from (Services::BaselineCalculator).
+      # @return [Hash] { hourly: Integer, daily: Integer, weekly: Integer }
+      def current_counts(application_id: nil)
+        relation = Services::BaselineCalculator.counting_relation(@error_type, @platform, application_id: application_id)
+        column = Services::BaselineCalculator.time_column
+        now = Time.current
+        {
+          hourly: relation.where("#{column} >= ?", now.beginning_of_hour).count,
+          daily: relation.where("#{column} >= ?", now.beginning_of_day).count,
+          weekly: relation.where("#{column} >= ?", now.beginning_of_week).count
+        }
+      end
+
+      # The anomaly check for right now: current counts against their baselines.
+      # @param application_id [Integer, nil] scope the current counts to one application
+      def check_current_anomaly(sensitivity: 2, application_id: nil)
+        check_anomaly(sensitivity: sensitivity, **current_counts(application_id: application_id))
+      end
     end
   end
 end

data/lib/rails_error_dashboard/queries/dashboard_stats.rb

@@ -181,14 +181,8 @@ module RailsErrorDashboard
 
         # Check most common error types for anomalies
         base_scope.distinct.pluck(:error_type, :platform).compact.any? do |(error_type, platform)|
-          stats = Queries::BaselineStats.new(error_type, platform)
-          error_count = base_scope.where(
-            error_type: error_type,
-            platform: platform
-          ).where("occurred_at >= ?", Time.current.beginning_of_day).count
-
-          result = stats.check_anomaly(error_count, sensitivity: 2)
-          result[:anomaly]
+          Queries::BaselineStats.new(error_type, platform)
+                                .check_current_anomaly(sensitivity: 2, application_id: @application_id)[:anomaly]
         end
       end
 
@@ -198,19 +192,14 @@ module RailsErrorDashboard
 
         # Find the most anomalous error type
         anomalies = base_scope.distinct.pluck(:error_type, :platform).compact.map do |(error_type, platform)|
-          stats = Queries::BaselineStats.new(error_type, platform)
-          error_count = base_scope.where(
-            error_type: error_type,
-            platform: platform
-          ).where("occurred_at >= ?", Time.current.beginning_of_day).count
-
-          result = stats.check_anomaly(error_count, sensitivity: 2)
+          result = Queries::BaselineStats.new(error_type, platform)
+                                         .check_current_anomaly(sensitivity: 2, application_id: @application_id)
           next unless result[:anomaly]
 
           {
             error_type: error_type,
             platform: platform,
-            count: error_count,
+            count: result[:current_count],
             level: result[:level],
             std_devs_above: result[:std_devs_above]
           }

data/lib/rails_error_dashboard/queries/release_timeline.rb

@@ -4,7 +4,18 @@ module RailsErrorDashboard
   module Queries
     # Query: Build a release timeline from error data, showing per-version health stats,
     # "new in this release" error detection, stability indicators, and release-over-release deltas.
-    # Uses existing app_version and git_sha columns on error_logs — no new migration needed.
+    #
+    # Counting unit: OCCURRENCES. An ErrorLog row is a group that keeps the
+    # release of its first capture, so counting rows attributed every later
+    # recurrence to that first release. Each occurrence carries the release it
+    # happened under (since the add_release_to_error_occurrences migration);
+    # before that migration is applied the query falls back to counting group
+    # rows as it always did. "New in this release" stays group-based on
+    # purpose: a group's first release IS where the error was new.
+    #
+    # Storm count-only events create no occurrence rows, so a release's total
+    # here is the number of captured events, which storm shedding can leave
+    # below the group's occurrence_count.
     class ReleaseTimeline
       def self.call(days = 30, application_id: nil)
         new(days, application_id: application_id).call
@@ -77,6 +88,8 @@ module RailsErrorDashboard
 
       # Single GROUP BY query for per-version aggregates
       def aggregate_version_stats
+        return aggregate_occurrence_stats if occurrences_carry_release?
+
         rows = base_scope
           .group(:app_version)
           .select(
@@ -119,6 +132,64 @@ module RailsErrorDashboard
         {}
       end
 
+      def occurrences_carry_release?
+        defined?(ErrorOccurrence) && ErrorOccurrence.table_exists? &&
+          ErrorOccurrence.column_names.include?("app_version")
+      rescue
+        false
+      end
+
+      def occurrence_scope
+        occurrences = ErrorOccurrence.table_name
+        scope = ErrorOccurrence.joins(:error_log)
+                               .where("#{occurrences}.occurred_at >= ?", @start_date)
+                               .where.not(occurrences => { app_version: [ nil, "" ] })
+        scope = scope.where(ErrorLog.table_name => { application_id: @application_id }) if @application_id.present?
+        scope
+      end
+
+      def aggregate_occurrence_stats
+        occurrences = ErrorOccurrence.table_name
+        logs = ErrorLog.table_name
+
+        rows = occurrence_scope
+          .group("#{occurrences}.app_version")
+          .select(
+            "#{occurrences}.app_version AS app_version",
+            "COUNT(*) AS total_count",
+            "COUNT(DISTINCT #{logs}.error_type) AS unique_types",
+            "MIN(#{occurrences}.occurred_at) AS first_seen_at",
+            "MAX(#{occurrences}.occurred_at) AS last_seen_at"
+          )
+
+        sha_map = {}
+        occurrence_scope.where.not(occurrences => { git_sha: [ nil, "" ] })
+                        .group("#{occurrences}.app_version", "#{occurrences}.git_sha")
+                        .pluck("#{occurrences}.app_version", "#{occurrences}.git_sha")
+                        .each do |version, sha|
+                          (sha_map[version] ||= []) << sha
+                        end
+        sha_map.each_value(&:uniq!)
+
+        rows.each_with_object({}) do |row, result|
+          first_seen = row.first_seen_at
+          last_seen = row.last_seen_at
+          first_seen = Time.zone.parse(first_seen) if first_seen.is_a?(String)
+          last_seen = Time.zone.parse(last_seen) if last_seen.is_a?(String)
+
+          result[row.app_version] = {
+            total_errors: row.total_count.to_i,
+            unique_error_types: row.unique_types.to_i,
+            first_seen: first_seen,
+            last_seen: last_seen,
+            git_shas: sha_map[row.app_version] || []
+          }
+        end
+      rescue => e
+        Rails.logger.error("[RailsErrorDashboard] ReleaseTimeline occurrence aggregate failed: #{e.class}: #{e.message}")
+        {}
+      end
+
       # For each error_hash in the window, find which app_version it first appeared in.
       # Count per version to get "new errors introduced in this release".
       def new_errors_per_version

data/lib/rails_error_dashboard/services/baseline_calculator.rb

@@ -72,79 +72,72 @@ module RailsErrorDashboard
         defined?(ErrorBaseline) && ErrorBaseline.table_exists?
       end
 
-      # Calculate hourly baseline (last 4 weeks, by hour of day)
-      def calculate_hourly_baseline(error_type, platform)
-        period_start = HOURLY_LOOKBACK.ago.beginning_of_hour
-        period_end = Time.current.beginning_of_hour
-
-        # Get error counts grouped by hour
-        hourly_counts = ErrorLog
-          .where(error_type: error_type, platform: platform)
-          .where("occurred_at >= ?", period_start)
-          .group("strftime('%H', occurred_at)")
-          .count
-
-        return nil if hourly_counts.empty?
-
-        counts = hourly_counts.values
-        stats = calculate_statistics(counts)
+      # The events a baseline is built from: occurrences of this error type on
+      # this platform (one row per captured event) when the occurrences table
+      # exists, else the group rows themselves. Public so the anomaly check
+      # counts the current period in exactly the same units.
+      #
+      # @param application_id [Integer, nil] restrict to one application's
+      #   events (the baselines themselves have no application dimension;
+      #   the current-period observation must still be scoped, or one app's
+      #   spike shows up as an anomaly on another app's dashboard)
+      def self.counting_relation(error_type, platform, application_id: nil)
+        conditions = { error_type: error_type, platform: platform }
+        conditions[:application_id] = application_id if application_id.present?
+
+        if defined?(ErrorOccurrence) && ErrorOccurrence.table_exists?
+          ErrorOccurrence.joins(:error_log).where(ErrorLog.table_name => conditions)
+        else
+          ErrorLog.where(conditions)
+        end
+      end
 
-        baseline = Commands::UpsertBaseline.call(
-          error_type: error_type, platform: platform, baseline_type: "hourly",
-          period_start: period_start, period_end: period_end,
-          stats: stats, count: counts.sum, sample_size: counts.size
-        )
+      # The timestamp column of #counting_relation, qualified for the join.
+      def self.time_column
+        if defined?(ErrorOccurrence) && ErrorOccurrence.table_exists?
+          "#{ErrorOccurrence.table_name}.occurred_at"
+        else
+          "occurred_at"
+        end
+      end
 
-        @calculated_count += 1
-        baseline
+      # Calculate hourly baseline (last 4 weeks, one sample per calendar hour)
+      def calculate_hourly_baseline(error_type, platform)
+        calculate_baseline(error_type, platform, "hourly", :hour,
+                           HOURLY_LOOKBACK.ago.beginning_of_hour, Time.current.beginning_of_hour)
       end
 
-      # Calculate daily baseline (last 12 weeks, by day of week)
+      # Calculate daily baseline (last 12 weeks, one sample per calendar day)
       def calculate_daily_baseline(error_type, platform)
-        period_start = DAILY_LOOKBACK.ago.beginning_of_day
-        period_end = Time.current.beginning_of_day
-
-        # Get error counts grouped by day
-        daily_counts = ErrorLog
-          .where(error_type: error_type, platform: platform)
-          .where("occurred_at >= ?", period_start)
-          .group("DATE(occurred_at)")
-          .count
-
-        return nil if daily_counts.empty?
-
-        counts = daily_counts.values
-        stats = calculate_statistics(counts)
-
-        baseline = Commands::UpsertBaseline.call(
-          error_type: error_type, platform: platform, baseline_type: "daily",
-          period_start: period_start, period_end: period_end,
-          stats: stats, count: counts.sum, sample_size: counts.size
-        )
-
-        @calculated_count += 1
-        baseline
+        calculate_baseline(error_type, platform, "daily", :day,
+                           DAILY_LOOKBACK.ago.beginning_of_day, Time.current.beginning_of_day)
       end
 
-      # Calculate weekly baseline (last 1 year, by week)
+      # Calculate weekly baseline (last 1 year, one sample per calendar week)
       def calculate_weekly_baseline(error_type, platform)
-        period_start = WEEKLY_LOOKBACK.ago.beginning_of_week
-        period_end = Time.current.beginning_of_week
-
-        # Get error counts grouped by week
-        weekly_counts = ErrorLog
-          .where(error_type: error_type, platform: platform)
-          .where("occurred_at >= ?", period_start)
-          .group("strftime('%Y-%W', occurred_at)")
-          .count
+        calculate_baseline(error_type, platform, "weekly", :week,
+                           WEEKLY_LOOKBACK.ago.beginning_of_week, Time.current.beginning_of_week)
+      end
 
-        return nil if weekly_counts.empty?
+      # One sample per DATED bucket across the whole lookback, zero buckets
+      # included, so the statistics describe "how many events in an hour /
+      # day / week" — the unit the anomaly check compares against.
+      #
+      # The previous implementation grouped four weeks by hour-of-day, which
+      # summed 28 days into at most 24 totals (seven noon failures on seven
+      # days: mean 7, sample size 1), dropped quiet periods, and embedded a
+      # SQLite-only date function so it could not run on PostgreSQL or MySQL
+      # at all. Groupdate does the bucketing per adapter.
+      def calculate_baseline(error_type, platform, baseline_type, period, period_start, period_end)
+        return nil if period_end <= period_start
+
+        counts = bucket_counts(error_type, platform, period, period_start, period_end)
+        return nil if counts.sum.zero?
 
-        counts = weekly_counts.values
         stats = calculate_statistics(counts)
 
         baseline = Commands::UpsertBaseline.call(
-          error_type: error_type, platform: platform, baseline_type: "weekly",
+          error_type: error_type, platform: platform, baseline_type: baseline_type,
           period_start: period_start, period_end: period_end,
           stats: stats, count: counts.sum, sample_size: counts.size
         )
@@ -153,6 +146,23 @@ module RailsErrorDashboard
         baseline
       end
 
+      # @return [Array<Integer>] one count per bucket in [period_start, period_end)
+      #
+      # Week boundaries and time zone are passed explicitly so the buckets
+      # line up with the Rails `beginning_of_week` / `Time.current` calls the
+      # period bounds and the anomaly check use. Groupdate's own default week
+      # starts on Sunday; Rails' starts on Monday, and with the two disagreeing
+      # a Sunday event and a Monday event landed in one bucket instead of two.
+      def bucket_counts(error_type, platform, period, period_start, period_end)
+        options = { range: period_start...period_end, time_zone: Time.zone }
+        options[:week_start] = Date.beginning_of_week if period == :week # groupdate rejects it for other periods
+
+        self.class.counting_relation(error_type, platform)
+            .group_by_period(period, self.class.time_column, **options)
+            .count
+            .values
+      end
+
       # === Pure algorithm methods (no database access) ===
       # These can be called directly as class methods for testability
 
@@ -168,9 +178,12 @@ module RailsErrorDashboard
       def self.calculate_statistics(counts)
         return default_stats if counts.empty?
 
-        # Remove outliers
+        # Remove outliers (a storm hour must not become the baseline) — but
+        # never the whole signal: for a rare error most zero-filled buckets
+        # are 0, the few 1s sit many sigmas out, and trimming them would
+        # leave a baseline that says the error never happens.
         clean_counts = remove_outliers(counts)
-        return default_stats if clean_counts.empty?
+        clean_counts = counts if clean_counts.empty? || (clean_counts.sum.zero? && counts.sum.positive?)
 
         mean = clean_counts.sum.to_f / clean_counts.size
         variance = clean_counts.map { |c| (c - mean)**2 }.sum / clean_counts.size

data/lib/rails_error_dashboard/services/error_hash_generator.rb

@@ -67,11 +67,20 @@ module RailsErrorDashboard
         Digest::SHA256.hexdigest(digest_input)[0..15]
       end
 
+      # Only this many leading characters of the RAW message take part in the
+      # hash. The storm gate stores a bounded exemplar (it must stay cheap and
+      # memory-bounded per fingerprint), so the full path has to hash the same
+      # prefix or a long-message error would change identity the moment the
+      # breaker changed state. Truncation happens BEFORE normalization so both
+      # paths see byte-identical input.
+      HASH_MESSAGE_LIMIT = 500
+
       # Normalize dynamic values in error messages for consistent hashing
       # @param message [String, nil] The error message
       # @return [String, nil] Normalized message
       def self.normalize_message(message)
         message
+          &.[](0, HASH_MESSAGE_LIMIT)
           &.gsub(/0x[0-9a-f]+/i, "HEX")          # Replace hex addresses (before numbers)
           &.gsub(/#<[^>]+>/, "#<OBJ>")           # Replace object inspections
           &.gsub(/\d+/, "N")                     # Replace numbers

data/lib/rails_error_dashboard/services/local_variable_capturer.rb

@@ -10,7 +10,10 @@ module RailsErrorDashboard
     #
     # Safety contract:
     # - Default OFF (opt-in via config.enable_local_variables / enable_instance_variables)
-    # - Never stores Binding objects or object references — extracts vars immediately in callback
+    # - Never stores Binding objects — extracts vars immediately in callback
+    # - Strings, arrays and hashes are snapshotted (shallow copy, bounded by the
+    #   serializer's limits) at raise time; other objects are kept by reference,
+    #   so their state is whatever it is when the error is serialized
     # - Every callback wrapped in rescue => e (never raises)
     # - Per-variable rescue in extraction
     # - Skips SystemExit, SignalException, Interrupt
@@ -117,6 +120,33 @@ module RailsErrorDashboard
           end
         end
 
+        # A value as it is NOW, for the kinds of value that are cheap to copy.
+        #
+        # The exception is serialized later, after the stack has unwound —
+        # and ensure blocks and rescue handlers run in between, mutating the
+        # very state worth seeing (`state["phase"] = "cleanup"`, `@conn = nil`).
+        # A reference would show the post-cleanup value and call it the value
+        # "at raise". Strings, arrays and hashes get a one-level copy, bounded
+        # by what the serializer will keep anyway (+1 so it still knows the
+        # original was longer). Anything else is left as a reference: copying
+        # arbitrary application objects is neither safe nor cheap. Nested
+        # containers inside the copy are therefore still references.
+        def snapshot_value(value)
+          config = RailsErrorDashboard.configuration
+          case value
+          when String
+            value.frozen? ? value : value[0, (config.local_variable_max_string_length || 200) + 1]
+          when Array
+            value.first((config.local_variable_max_array_items || 10) + 1)
+          when Hash
+            value.first((config.local_variable_max_hash_items || 20) + 1).to_h
+          else
+            value
+          end
+        rescue
+          value
+        end
+
         # Check if the path should be skipped (gem code, vendor, stdlib, this gem)
         def skip_path?(path)
           path.include?("/gems/") ||
@@ -142,7 +172,7 @@ module RailsErrorDashboard
 
           locals = {}
           var_names.each do |name|
-            locals[name] = binding_obj.local_variable_get(name)
+            locals[name] = snapshot_value(binding_obj.local_variable_get(name))
           rescue => e
             locals[name] = "(extraction error: #{e.class.name})"
           end
@@ -189,7 +219,7 @@ module RailsErrorDashboard
 
           # Extract each instance variable (per-variable rescue)
           ivar_names.each do |name|
-            result[name] = obj.instance_variable_get(name)
+            result[name] = snapshot_value(obj.instance_variable_get(name))
           rescue => e
             result[name] = "(extraction error: #{e.class.name})"
           end

data/lib/rails_error_dashboard/services/storm_protection/count_buffer.rb

@@ -17,12 +17,18 @@ module RailsErrorDashboard
       # Memory: bounded map; beyond the cap events land in a single overflow
       # counter (still exact in total, anonymous in identity).
       #
-      # Concurrency: snapshot! atomically swaps the whole map out via
-      # AtomicReference, so flushing never races with recording.
+      # Concurrency: a read/write lock. Every record holds the READ lock for
+      # the few instructions between reading the map reference and bumping
+      # the entry's counter; snapshot! takes the WRITE lock only to swap the
+      # map out. So once the swap returns no writer can still be holding the
+      # old map, and the old map is quiescent while it is serialized outside
+      # the lock. AtomicReference alone was not enough: a writer that read the
+      # old reference just before the swap would increment a map nobody would
+      # ever read again, and the "exact" count lost an event.
       class CountBuffer
         Entry = Struct.new(
           :error_class, :message, :first_app_frame,
-          :controller_name, :action_name, :custom_hash,
+          :controller_name, :action_name, :custom_hash, :environment,
           :count, :first_seen_at, :last_seen_at
         )
 
@@ -31,6 +37,7 @@ module RailsErrorDashboard
         end
 
         def reset!
+          @lock = Concurrent::ReadWriteLock.new
           @map_ref = Concurrent::AtomicReference.new(Concurrent::Map.new)
           @overflow = Concurrent::AtomicFixnum.new(0)
         end
@@ -39,25 +46,31 @@ module RailsErrorDashboard
         # @param gate_key [String] cheap in-process bucketing key
         # @param parts [Hash] identity parts captured at the gate
         def record(gate_key, parts)
-          map = @map_ref.get
-          entry = map[gate_key]
+          @lock.with_read_lock { add(gate_key, parts, 1, Time.current, Time.current) }
+        end
 
-          unless entry
-            if map.size >= max_tracked
-              @overflow.increment
-              return
-            end
-            entry = map.compute_if_absent(gate_key) do
-              Entry.new(
-                parts[:error_class], parts[:message], parts[:first_app_frame],
-                parts[:controller_name], parts[:action_name], parts[:custom_hash],
-                Concurrent::AtomicFixnum.new(0), Time.current, Time.current
+        # Put a snapshot BACK when its handoff failed (the flush job could not
+        # be enqueued). Counts merge into whatever accumulated since the swap;
+        # first_seen_at keeps the earliest of the two; beyond the map cap the
+        # events land in the overflow bucket — exact in total, as always.
+        # @param entries [Array<Hash>] entries from #snapshot!
+        # @param overflow [Integer] overflow from #snapshot!
+        def restore(entries, overflow = 0)
+          @lock.with_read_lock do
+            Array(entries).each do |entry|
+              entry = entry.with_indifferent_access if entry.respond_to?(:with_indifferent_access)
+              next unless entry.is_a?(Hash)
+
+              add(
+                entry["gate_key"],
+                parts_from(entry),
+                entry["count"].to_i,
+                parse_time(entry["first_seen_at"]),
+                parse_time(entry["last_seen_at"])
               )
             end
+            @overflow.increment(overflow.to_i) if overflow.to_i.positive?
           end
-
-          entry.count.increment
-          entry.last_seen_at = Time.current
         end
 
         def any?
@@ -67,19 +80,23 @@ module RailsErrorDashboard
         # Atomically swap the buffer out and return serializable entry hashes.
         # @return [Hash] { entries: Array<Hash>, overflow: Integer }
         def snapshot!
-          old_map = @map_ref.get_and_set(Concurrent::Map.new)
-          overflow = @overflow.value
-          @overflow.update { |v| v - overflow }
+          old_map, overflow = @lock.with_write_lock do
+            taken = @overflow.value
+            @overflow.update { |v| v - taken }
+            [ @map_ref.get_and_set(Concurrent::Map.new), taken ]
+          end
 
           entries = []
-          old_map.each_pair do |_key, entry|
+          old_map.each_pair do |key, entry|
             entries << {
+              "gate_key" => key,
               "error_class" => entry.error_class,
               "message" => entry.message,
               "first_app_frame" => entry.first_app_frame,
               "controller_name" => entry.controller_name,
               "action_name" => entry.action_name,
               "custom_hash" => entry.custom_hash,
+              "environment" => entry.environment,
               "count" => entry.count.value,
               "first_seen_at" => entry.first_seen_at.iso8601,
               "last_seen_at" => entry.last_seen_at.iso8601
@@ -91,6 +108,50 @@ module RailsErrorDashboard
 
         private
 
+        # Callers hold the read lock.
+        def add(gate_key, parts, count, first_seen_at, last_seen_at)
+          return if count <= 0
+
+          map = @map_ref.get
+          entry = map[gate_key]
+
+          unless entry
+            if map.size >= max_tracked
+              @overflow.increment(count)
+              return
+            end
+            entry = map.compute_if_absent(gate_key) do
+              Entry.new(
+                parts[:error_class], parts[:message], parts[:first_app_frame],
+                parts[:controller_name], parts[:action_name], parts[:custom_hash], parts[:environment],
+                Concurrent::AtomicFixnum.new(0), first_seen_at || Time.current, last_seen_at || Time.current
+              )
+            end
+          end
+
+          entry.count.increment(count)
+          entry.last_seen_at = [ entry.last_seen_at, last_seen_at ].compact.max
+          entry.first_seen_at = [ entry.first_seen_at, first_seen_at ].compact.min
+        end
+
+        def parts_from(entry)
+          {
+            error_class: entry["error_class"], message: entry["message"],
+            first_app_frame: entry["first_app_frame"], controller_name: entry["controller_name"],
+            action_name: entry["action_name"], custom_hash: entry["custom_hash"],
+            environment: entry["environment"]
+          }
+        end
+
+        def parse_time(value)
+          return value if value.is_a?(Time) || value.is_a?(ActiveSupport::TimeWithZone)
+          return nil if value.blank?
+
+          Time.zone.parse(value.to_s)
+        rescue ArgumentError
+          nil
+        end
+
         def max_tracked
           RailsErrorDashboard.configuration.storm_max_tracked_fingerprints.to_i
         end