@nockdev/awf 6.2.0 → 6.2.2

package/.agent/skills/core/logging/data/aggregation-patterns.yaml

@@ -1,191 +1,191 @@
 metadata:
   skill: logging
   domain: aggregation_patterns
-  version: 6.2.0
-  updated: '2026-02-05'
-  migrated_from: aggregation-patterns.csv
+  version: 6.2.2
+  updated: "2026-02-05"
+  migrated_from: aggregation-patterns.yaml
   patterns_count: 25
   columns:
-  - pattern_id
-  - category
-  - platform
-  - name
-  - description
-  - example
-  - when_to_use
+    - pattern_id
+    - category
+    - platform
+    - name
+    - description
+    - example
+    - when_to_use
 patterns:
-- id: AGG-001
-  category: elk
-  platform: Elasticsearch
-  name: Index Template
-  description: Define index structure
-  example: 'PUT _index_template/logs { "index_patterns": ["logs-*"] }'
-  when_to_use: ELK setup
-- id: AGG-002
-  category: elk
-  platform: Elasticsearch
-  name: ILM Policy
-  description: Index lifecycle management
-  example: 'PUT _ilm/policy/logs-policy { "phases": { "hot": {}, "warm": {} } }'
-  when_to_use: Log retention
-- id: AGG-003
-  category: elk
-  platform: Logstash
-  name: Input Plugin
-  description: Log ingestion
-  example: input { beats { port => 5044 } }
-  when_to_use: Receiving logs
-- id: AGG-004
-  category: elk
-  platform: Logstash
-  name: Filter Pipeline
-  description: Transform logs
-  example: filter { json { source => "message" } }
-  when_to_use: Log parsing
-- id: AGG-005
-  category: elk
-  platform: Logstash
-  name: Output Plugin
-  description: Send to Elasticsearch
-  example: output { elasticsearch { hosts => ["localhost:9200"] } }
-  when_to_use: Indexing logs
-- id: AGG-006
-  category: elk
-  platform: Kibana
-  name: Discover
-  description: Search logs
-  example: 'Use KQL: level:ERROR AND service:api'
-  when_to_use: Log exploration
-- id: AGG-007
-  category: elk
-  platform: Kibana
-  name: Dashboard
-  description: Visualize logs
-  example: Create panels for error rates, response times
-  when_to_use: Monitoring
-- id: AGG-008
-  category: filebeat
-  platform: Filebeat
-  name: filebeat.inputs
-  description: Collect log files
-  example: 'filebeat.inputs: [{type: log, paths: [''/var/log/*.log'']}]'
-  when_to_use: Log shipping
-- id: AGG-009
-  category: loki
-  platform: Loki
-  name: Labels
-  description: Index by labels
-  example: '{app="myapp", env="prod"}'
-  when_to_use: Cost-effective logging
-- id: AGG-010
-  category: loki
-  platform: Loki
-  name: LogQL
-  description: Query language
-  example: '''{app="myapp"} |= "error" | json | line_format "{{.message}}"'''
-  when_to_use: Log querying
-- id: AGG-011
-  category: loki
-  platform: Promtail
-  name: scrape_configs
-  description: Log collection
-  example: 'scrape_configs: [{job_name: system, static_configs: [...]}]'
-  when_to_use: Loki ingestion
-- id: AGG-012
-  category: loki
-  platform: Grafana
-  name: Explore
-  description: Loki in Grafana
-  example: Use Explore panel with Loki datasource
-  when_to_use: Log exploration
-- id: AGG-013
-  category: splunk
-  platform: Splunk
-  name: HEC
-  description: HTTP Event Collector
-  example: POST /services/collector/event with token auth
-  when_to_use: Splunk ingestion
-- id: AGG-014
-  category: splunk
-  platform: Splunk
-  name: SPL
-  description: Search Processing Language
-  example: index=main sourcetype=json | stats count by level
-  when_to_use: Log analysis
-- id: AGG-015
-  category: splunk
-  platform: Splunk
-  name: Saved Search
-  description: Scheduled search
-  example: Create alerts for error patterns
-  when_to_use: Alerting
-- id: AGG-016
-  category: cloud
-  platform: CloudWatch
-  name: Log Groups
-  description: AWS log organization
-  example: aws logs create-log-group --log-group-name /app/myservice
-  when_to_use: AWS logging
-- id: AGG-017
-  category: cloud
-  platform: CloudWatch
-  name: Insights
-  description: CloudWatch query
-  example: fields @timestamp, @message | filter level = 'ERROR'
-  when_to_use: AWS log analysis
-- id: AGG-018
-  category: cloud
-  platform: Cloud Logging
-  name: Structured Logs
-  description: GCP structured
-  example: jsonPayload.level = "ERROR"
-  when_to_use: GCP logging
-- id: AGG-019
-  category: cloud
-  platform: Cloud Logging
-  name: Log Router
-  description: Route to BigQuery
-  example: Create sink to BigQuery for analytics
-  when_to_use: GCP log routing
-- id: AGG-020
-  category: cloud
-  platform: Azure Monitor
-  name: Diagnostic Settings
-  description: Azure log config
-  example: Create diagnostic setting to Log Analytics
-  when_to_use: Azure logging
-- id: AGG-021
-  category: fluentd
-  platform: Fluentd
-  name: source
-  description: Log input
-  example: <source> @type tail path /var/log/*.log </source>
-  when_to_use: Multi-source collection
-- id: AGG-022
-  category: fluentd
-  platform: Fluentd
-  name: match
-  description: Log routing
-  example: <match app.**> @type elasticsearch </match>
-  when_to_use: Log forwarding
-- id: AGG-023
-  category: fluentbit
-  platform: Fluent Bit
-  name: Lightweight Agent
-  description: Resource-efficient
-  example: '[INPUT] Name tail Path /var/log/*.log'
-  when_to_use: Edge/container logging
-- id: AGG-024
-  category: vector
-  platform: Vector
-  name: Pipeline
-  description: High-performance agent
-  example: 'sources: { logs: { type: file } }'
-  when_to_use: Modern log shipping
-- id: AGG-025
-  category: general
-  platform: any
-  name: Centralization Pattern
-  description: Unified log platform
-  example: All services → Aggregator → Storage → Visualization
-  when_to_use: Architecture
+  - id: AGG-001
+    category: elk
+    platform: Elasticsearch
+    name: Index Template
+    description: Define index structure
+    example: 'PUT _index_template/logs { "index_patterns": ["logs-*"] }'
+    when_to_use: ELK setup
+  - id: AGG-002
+    category: elk
+    platform: Elasticsearch
+    name: ILM Policy
+    description: Index lifecycle management
+    example: 'PUT _ilm/policy/logs-policy { "phases": { "hot": {}, "warm": {} } }'
+    when_to_use: Log retention
+  - id: AGG-003
+    category: elk
+    platform: Logstash
+    name: Input Plugin
+    description: Log ingestion
+    example: input { beats { port => 5044 } }
+    when_to_use: Receiving logs
+  - id: AGG-004
+    category: elk
+    platform: Logstash
+    name: Filter Pipeline
+    description: Transform logs
+    example: filter { json { source => "message" } }
+    when_to_use: Log parsing
+  - id: AGG-005
+    category: elk
+    platform: Logstash
+    name: Output Plugin
+    description: Send to Elasticsearch
+    example: output { elasticsearch { hosts => ["localhost:9200"] } }
+    when_to_use: Indexing logs
+  - id: AGG-006
+    category: elk
+    platform: Kibana
+    name: Discover
+    description: Search logs
+    example: "Use KQL: level:ERROR AND service:api"
+    when_to_use: Log exploration
+  - id: AGG-007
+    category: elk
+    platform: Kibana
+    name: Dashboard
+    description: Visualize logs
+    example: Create panels for error rates, response times
+    when_to_use: Monitoring
+  - id: AGG-008
+    category: filebeat
+    platform: Filebeat
+    name: filebeat.inputs
+    description: Collect log files
+    example: "filebeat.inputs: [{type: log, paths: ['/var/log/*.log']}]"
+    when_to_use: Log shipping
+  - id: AGG-009
+    category: loki
+    platform: Loki
+    name: Labels
+    description: Index by labels
+    example: '{app="myapp", env="prod"}'
+    when_to_use: Cost-effective logging
+  - id: AGG-010
+    category: loki
+    platform: Loki
+    name: LogQL
+    description: Query language
+    example: '''{app="myapp"} |= "error" | json | line_format "{{.message}}"'''
+    when_to_use: Log querying
+  - id: AGG-011
+    category: loki
+    platform: Promtail
+    name: scrape_configs
+    description: Log collection
+    example: "scrape_configs: [{job_name: system, static_configs: [...]}]"
+    when_to_use: Loki ingestion
+  - id: AGG-012
+    category: loki
+    platform: Grafana
+    name: Explore
+    description: Loki in Grafana
+    example: Use Explore panel with Loki datasource
+    when_to_use: Log exploration
+  - id: AGG-013
+    category: splunk
+    platform: Splunk
+    name: HEC
+    description: HTTP Event Collector
+    example: POST /services/collector/event with token auth
+    when_to_use: Splunk ingestion
+  - id: AGG-014
+    category: splunk
+    platform: Splunk
+    name: SPL
+    description: Search Processing Language
+    example: index=main sourcetype=json | stats count by level
+    when_to_use: Log analysis
+  - id: AGG-015
+    category: splunk
+    platform: Splunk
+    name: Saved Search
+    description: Scheduled search
+    example: Create alerts for error patterns
+    when_to_use: Alerting
+  - id: AGG-016
+    category: cloud
+    platform: CloudWatch
+    name: Log Groups
+    description: AWS log organization
+    example: aws logs create-log-group --log-group-name /app/myservice
+    when_to_use: AWS logging
+  - id: AGG-017
+    category: cloud
+    platform: CloudWatch
+    name: Insights
+    description: CloudWatch query
+    example: fields @timestamp, @message | filter level = 'ERROR'
+    when_to_use: AWS log analysis
+  - id: AGG-018
+    category: cloud
+    platform: Cloud Logging
+    name: Structured Logs
+    description: GCP structured
+    example: jsonPayload.level = "ERROR"
+    when_to_use: GCP logging
+  - id: AGG-019
+    category: cloud
+    platform: Cloud Logging
+    name: Log Router
+    description: Route to BigQuery
+    example: Create sink to BigQuery for analytics
+    when_to_use: GCP log routing
+  - id: AGG-020
+    category: cloud
+    platform: Azure Monitor
+    name: Diagnostic Settings
+    description: Azure log config
+    example: Create diagnostic setting to Log Analytics
+    when_to_use: Azure logging
+  - id: AGG-021
+    category: fluentd
+    platform: Fluentd
+    name: source
+    description: Log input
+    example: <source> @type tail path /var/log/*.log </source>
+    when_to_use: Multi-source collection
+  - id: AGG-022
+    category: fluentd
+    platform: Fluentd
+    name: match
+    description: Log routing
+    example: <match app.**> @type elasticsearch </match>
+    when_to_use: Log forwarding
+  - id: AGG-023
+    category: fluentbit
+    platform: Fluent Bit
+    name: Lightweight Agent
+    description: Resource-efficient
+    example: "[INPUT] Name tail Path /var/log/*.log"
+    when_to_use: Edge/container logging
+  - id: AGG-024
+    category: vector
+    platform: Vector
+    name: Pipeline
+    description: High-performance agent
+    example: "sources: { logs: { type: file } }"
+    when_to_use: Modern log shipping
+  - id: AGG-025
+    category: general
+    platform: any
+    name: Centralization Pattern
+    description: Unified log platform
+    example: All services → Aggregator → Storage → Visualization
+    when_to_use: Architecture

package/.agent/skills/core/logging/data/anti-patterns.yaml

@@ -1,121 +1,121 @@
 metadata:
   skill: logging
   domain: anti_patterns
-  version: 6.2.0
-  updated: '2026-02-05'
-  migrated_from: anti-patterns.csv
+  version: 6.2.2
+  updated: "2026-02-05"
+  migrated_from: anti-patterns.yaml
   patterns_count: 15
   columns:
-  - pattern_id
-  - category
-  - name
-  - description
-  - bad_example
-  - good_example
-  - impact
+    - pattern_id
+    - category
+    - name
+    - description
+    - bad_example
+    - good_example
+    - impact
 patterns:
-- id: ANTI-001
-  category: basics
-  name: Console in Production
-  description: Using console.log/print in production
-  bad_example: console.log('User:', user)
-  good_example: 'logger.info({ userId: user.id }, ''User action'')'
-  impact: Unstructured unmaintainable logs
-- id: ANTI-002
-  category: basics
-  name: No Log Levels
-  description: Not using log levels
-  bad_example: print('An error occurred')
-  good_example: logger.error('Failed to process', err)
-  impact: Cannot filter by severity
-- id: ANTI-003
-  category: basics
-  name: String Concatenation
-  description: Building log strings eagerly
-  bad_example: logger.debug('User ' + userId + ' action')
-  good_example: logger.debug({ userId }, 'User action')
-  impact: Performance overhead
-- id: ANTI-004
-  category: security
-  name: Logging Passwords
-  description: Including passwords in logs
-  bad_example: logger.info('Login', { password })
-  good_example: logger.info('Login', { userId }) // never password
-  impact: Security vulnerability
-- id: ANTI-005
-  category: security
-  name: Logging PII
-  description: Including personal data
-  bad_example: logger.info({ email, ssn, address })
-  good_example: logger.info({ userId }) // mask or omit PII
-  impact: Privacy violation
-- id: ANTI-006
-  category: security
-  name: Logging Tokens
-  description: Including auth tokens
-  bad_example: logger.debug({ accessToken })
-  good_example: 'logger.debug({ tokenHash: hash(token) })'
-  impact: Token exposure
-- id: ANTI-007
-  category: context
-  name: No Context
-  description: Logs without identifying information
-  bad_example: logger.error('Request failed')
-  good_example: logger.error({ requestId, userId }, 'Request failed')
-  impact: Cannot trace issues
-- id: ANTI-008
-  category: context
-  name: No Timestamp
-  description: Missing or inconsistent timestamps
-  bad_example: 'Custom format: 01/15/24'
-  good_example: 'ISO 8601: 2024-01-15T10:30:00Z'
-  impact: Correlation issues
-- id: ANTI-009
-  category: context
-  name: No Correlation ID
-  description: No request tracing
-  bad_example: logger.info('Processing')
-  good_example: logger.info({ traceId, spanId }, 'Processing')
-  impact: Cannot trace distributed requests
-- id: ANTI-010
-  category: performance
-  name: Sync File Logging
-  description: Blocking file I/O
-  bad_example: fs.writeFileSync(logFile, msg)
-  good_example: Use async logger or buffer
-  impact: Application slowdown
-- id: ANTI-011
-  category: performance
-  name: Over-Logging
-  description: Logging every small event
-  bad_example: for (item in items) logger.debug(item)
-  good_example: 'logger.debug({ count: items.length }, ''Processing batch'')'
-  impact: Performance and storage issues
-- id: ANTI-012
-  category: structure
-  name: Inconsistent Format
-  description: Mixed log formats
-  bad_example: Some JSON some text
-  good_example: Consistent JSON across all services
-  impact: Parsing difficulties
-- id: ANTI-013
-  category: structure
-  name: Deep Nesting
-  description: Deeply nested log objects
-  bad_example: '{ user: { account: { profile: { ... } } } }'
-  good_example: Flatten to 2-3 levels max
-  impact: Query performance
-- id: ANTI-014
-  category: operations
-  name: No Rotation
-  description: Unbounded log files
-  bad_example: Single growing log file
-  good_example: Rotate by size or time
-  impact: Disk exhaustion
-- id: ANTI-015
-  category: operations
-  name: No Retention
-  description: Keeping logs forever
-  bad_example: No deletion policy
-  good_example: 'Hot: 7d, Warm: 30d, Cold: 1yr'
-  impact: Storage cost explosion
+  - id: ANTI-001
+    category: basics
+    name: Console in Production
+    description: Using console.log/print in production
+    bad_example: console.log('User:', user)
+    good_example: "logger.info({ userId: user.id }, 'User action')"
+    impact: Unstructured unmaintainable logs
+  - id: ANTI-002
+    category: basics
+    name: No Log Levels
+    description: Not using log levels
+    bad_example: print('An error occurred')
+    good_example: logger.error('Failed to process', err)
+    impact: Cannot filter by severity
+  - id: ANTI-003
+    category: basics
+    name: String Concatenation
+    description: Building log strings eagerly
+    bad_example: logger.debug('User ' + userId + ' action')
+    good_example: logger.debug({ userId }, 'User action')
+    impact: Performance overhead
+  - id: ANTI-004
+    category: security
+    name: Logging Passwords
+    description: Including passwords in logs
+    bad_example: logger.info('Login', { password })
+    good_example: logger.info('Login', { userId }) // never password
+    impact: Security vulnerability
+  - id: ANTI-005
+    category: security
+    name: Logging PII
+    description: Including personal data
+    bad_example: logger.info({ email, ssn, address })
+    good_example: logger.info({ userId }) // mask or omit PII
+    impact: Privacy violation
+  - id: ANTI-006
+    category: security
+    name: Logging Tokens
+    description: Including auth tokens
+    bad_example: logger.debug({ accessToken })
+    good_example: "logger.debug({ tokenHash: hash(token) })"
+    impact: Token exposure
+  - id: ANTI-007
+    category: context
+    name: No Context
+    description: Logs without identifying information
+    bad_example: logger.error('Request failed')
+    good_example: logger.error({ requestId, userId }, 'Request failed')
+    impact: Cannot trace issues
+  - id: ANTI-008
+    category: context
+    name: No Timestamp
+    description: Missing or inconsistent timestamps
+    bad_example: "Custom format: 01/15/24"
+    good_example: "ISO 8601: 2024-01-15T10:30:00Z"
+    impact: Correlation issues
+  - id: ANTI-009
+    category: context
+    name: No Correlation ID
+    description: No request tracing
+    bad_example: logger.info('Processing')
+    good_example: logger.info({ traceId, spanId }, 'Processing')
+    impact: Cannot trace distributed requests
+  - id: ANTI-010
+    category: performance
+    name: Sync File Logging
+    description: Blocking file I/O
+    bad_example: fs.writeFileSync(logFile, msg)
+    good_example: Use async logger or buffer
+    impact: Application slowdown
+  - id: ANTI-011
+    category: performance
+    name: Over-Logging
+    description: Logging every small event
+    bad_example: for (item in items) logger.debug(item)
+    good_example: "logger.debug({ count: items.length }, 'Processing batch')"
+    impact: Performance and storage issues
+  - id: ANTI-012
+    category: structure
+    name: Inconsistent Format
+    description: Mixed log formats
+    bad_example: Some JSON some text
+    good_example: Consistent JSON across all services
+    impact: Parsing difficulties
+  - id: ANTI-013
+    category: structure
+    name: Deep Nesting
+    description: Deeply nested log objects
+    bad_example: "{ user: { account: { profile: { ... } } } }"
+    good_example: Flatten to 2-3 levels max
+    impact: Query performance
+  - id: ANTI-014
+    category: operations
+    name: No Rotation
+    description: Unbounded log files
+    bad_example: Single growing log file
+    good_example: Rotate by size or time
+    impact: Disk exhaustion
+  - id: ANTI-015
+    category: operations
+    name: No Retention
+    description: Keeping logs forever
+    bad_example: No deletion policy
+    good_example: "Hot: 7d, Warm: 30d, Cold: 1yr"
+    impact: Storage cost explosion