@oneuptime/common 12.0.14 → 12.0.16

package/Utils/Telemetry/LogErrorPattern.ts

@@ -0,0 +1,350 @@
+/*
+ * Error-message clustering for the Logs Insights surface.
+ *
+ * "30 x connection refused" is only a useful headline if the thirty raw
+ * bodies — each carrying its own timestamp, request id, port and latency —
+ * collapse onto one row. That collapse is a normalization: every span of
+ * text that varies per occurrence is rewritten to a placeholder, and what
+ * remains is the pattern the occurrences share.
+ *
+ * The rule table below is the single source of truth for that rewrite. It
+ * is consumed twice:
+ *
+ *   - by `normalizeLogBodyToErrorPattern` here, in plain JavaScript, for
+ *     client-side previews and for the test suite; and
+ *   - by Common/Server/Utils/Telemetry/LogErrorPatternSql, which compiles
+ *     the same rules into a nest of ClickHouse `replaceRegexpAll` calls so
+ *     the GROUP BY happens in the database over the whole window rather
+ *     than over a sampled page of rows.
+ *
+ * Because both readers share this table they cannot drift apart, and every
+ * pattern here is therefore restricted to the syntax BOTH engines accept:
+ * RE2 (ClickHouse) has no lookaround and no backreferences, so rules use
+ * only character classes, quantifiers, alternation and `\b`.
+ *
+ * Rule ORDER is part of the contract — rules apply in sequence, each over
+ * the output of the last:
+ *
+ *   1. timestamps first, because their digits and dashes would otherwise be
+ *      shredded by the numeric rule into an unrecognizable shape;
+ *   2. URLs before emails and IPs, so `https://user@10.0.0.1/x` collapses
+ *      to one `<url>` instead of three overlapping placeholders;
+ *   3. long hex runs before numbers, so a trace id stays one token;
+ *   4. numbers last of the value rules, as the catch-all;
+ *   5. whitespace collapse at the end, which is also what flattens a
+ *      multi-line stack trace into a single groupable line.
+ */
+
+export interface LogErrorPatternRule {
+  /** Stable identifier — used by tests and by the SQL compiler's comments. */
+  name: string;
+  /**
+   * Regular expression source accepted by BOTH the JavaScript engine and
+   * RE2. Applied globally (every match is replaced).
+   */
+  pattern: string;
+  /** Literal replacement text. Never contains `$` or `\` — see below. */
+  replacement: string;
+}
+
+/**
+ * The normalization rules, in application order. See the file header for
+ * why the order matters.
+ *
+ * Replacements are deliberately plain literals: `String.replace` treats
+ * `$&`/`$1` in a replacement specially and ClickHouse treats `\1`
+ * specially, so keeping them free of both characters means the two engines
+ * substitute identical text.
+ */
+export const LOG_ERROR_PATTERN_RULES: Array<LogErrorPatternRule> = [
+  {
+    name: "timestamp",
+    pattern:
+      "\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:?\\d{2})?",
+    replacement: "<timestamp>",
+  },
+  {
+    name: "uuid",
+    pattern:
+      "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}",
+    replacement: "<uuid>",
+  },
+  {
+    /*
+     * Before `email` and `ip`: a URL can contain both, and the whole URL is
+     * the varying part.
+     */
+    name: "url",
+    pattern: "[a-zA-Z][a-zA-Z0-9+.-]*://[^\\s\"'<>]+",
+    replacement: "<url>",
+  },
+  {
+    name: "email",
+    pattern: "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}",
+    replacement: "<email>",
+  },
+  {
+    name: "ip",
+    pattern: "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}",
+    replacement: "<ip>",
+  },
+  {
+    /*
+     * Trace ids, span ids, content hashes, object ids. 16 is the shortest
+     * run this fires on so ordinary hex-looking words ("deadbeef", "cafe")
+     * survive as themselves.
+     */
+    name: "hex",
+    pattern: "\\b[0-9a-fA-F]{16,}\\b",
+    replacement: "<hex>",
+  },
+  /*
+   * DELIBERATELY NO "mask any quoted span" RULE HERE.
+   *
+   * A `"[^"]*"` -> `"<str>"` rule looks reasonable on prose like
+   * `unknown field "customerRef"`, and it is catastrophic on structured
+   * logs. In JSON and logfmt — the two commonest shapes there are — the
+   * human-readable message IS a quoted value, so such a rule masks the only
+   * part that identifies the error:
+   *
+   *   {"level":"error","msg":"connection refused","attempt":3}
+   *   {"level":"error","msg":"permission denied","attempt":3}
+   *
+   * would both collapse to `{"<str>":"<str>","<str>":"<str>","<str>":<num>}`,
+   * summing two unrelated failures into one Top Errors row headed by
+   * whichever sample body argMax happened to pick.
+   *
+   * Nothing is lost by leaving it out: every quoted span that genuinely
+   * VARIES is a uuid, number, ip, url, timestamp, hex id or email, and the
+   * rules above already mask those — more informatively, since `"<uuid>"`
+   * says more than `"<str>"`. All such a rule uniquely added was collapsing
+   * quoted WORDS, which is exactly the destructive case. Two different
+   * quoted field names therefore stay two rows: under-collapsing is the
+   * safe direction, because a split incident is still visible while a
+   * merged one is hidden.
+   */
+  {
+    name: "number",
+    pattern: "\\d+(\\.\\d+)?",
+    replacement: "<num>",
+  },
+  {
+    /*
+     * Last: collapses the newlines and indentation of a stack trace onto
+     * one line so the truncation below keeps the exception type and the
+     * top frames — the part that identifies the error.
+     */
+    name: "whitespace",
+    pattern: "\\s+",
+    replacement: " ",
+  },
+];
+
+/**
+ * Longest pattern kept, in characters.
+ *
+ * A stack trace normalizes to a very long single line; grouping on the
+ * whole thing would split occurrences whose tails differ (different frame
+ * counts, different truncation by the emitting library) while adding
+ * nothing to what identifies the error. 300 characters comfortably covers
+ * an exception type plus its first frames.
+ */
+export const LOG_ERROR_PATTERN_MAX_LENGTH: number = 300;
+
+/**
+ * The placeholders the rules can emit. Exported so consumers (the deep-link
+ * builder below, the UI's pattern renderer) can recognize the variable
+ * spans without re-deriving them from the rule table.
+ */
+export const LOG_ERROR_PATTERN_PLACEHOLDERS: Array<string> =
+  LOG_ERROR_PATTERN_RULES.filter((rule: LogErrorPatternRule): boolean => {
+    return rule.replacement.startsWith("<") && rule.replacement.endsWith(">");
+  }).map((rule: LogErrorPatternRule): string => {
+    return rule.replacement;
+  });
+
+/*
+ * Any placeholder token, for splitting a pattern back into its literal
+ * spans. Matches the shape every rule's replacement uses rather than being
+ * built from the table itself, so a rule added later is understood here
+ * without a second edit.
+ */
+const PLACEHOLDER_TOKEN: RegExp = /<[a-z]+>/g;
+
+/**
+ * Collapse one raw log body to its error pattern.
+ *
+ * Non-string input (a log row can arrive with a null/absent body) yields
+ * the empty string rather than throwing, because this runs over rows the
+ * caller did not construct.
+ */
+export function normalizeLogBodyToErrorPattern(
+  body: string | undefined | null,
+): string {
+  if (typeof body !== "string" || body.length === 0) {
+    return "";
+  }
+
+  let normalized: string = body;
+
+  for (const rule of LOG_ERROR_PATTERN_RULES) {
+    /*
+     * A replacer function rather than the literal string: it makes the `$`
+     * substitution rules of String.replace unreachable, so the replacement
+     * text is inserted verbatim exactly as ClickHouse inserts it.
+     */
+    normalized = normalized.replace(
+      new RegExp(rule.pattern, "g"),
+      (): string => {
+        return rule.replacement;
+      },
+    );
+  }
+
+  normalized = normalized.trim();
+
+  if (normalized.length > LOG_ERROR_PATTERN_MAX_LENGTH) {
+    normalized = normalized.slice(0, LOG_ERROR_PATTERN_MAX_LENGTH).trim();
+  }
+
+  return normalized;
+}
+
+export interface ErrorPatternSearchTextOptions {
+  /** Literal runs shorter than this are not selective enough to be useful. */
+  minimumLength?: number | undefined;
+  /**
+   * A real body from the group, when the caller has one. Used to CHECK a
+   * candidate rather than to produce it — see below.
+   */
+  sampleBody?: string | undefined;
+}
+
+/*
+ * Leading punctuation a placeholder leaves behind — `to <ip>:<num>` splits
+ * into `to ` and `:` — so the search text comes out as words, not as the
+ * glue between them.
+ */
+const LEADING_GLUE: RegExp = /^[\s"':,;=([{]+/;
+
+/*
+ * Named rather than inlined at the use sites: an inline literal used as
+ * `/\s/.test(x)` trips eslint's wrap-regex, whose fix prettier then undoes
+ * (the same fight CrossSignalScope documents).
+ */
+const ANY_WHITESPACE: RegExp = /\s/;
+const WHITESPACE_RUN: RegExp = /\s+/;
+
+/**
+ * A literal run from the pattern that can be handed to a substring search.
+ *
+ * This is what turns "Insights says this happened 30 times" into a Logs
+ * viewer deep link that actually lists those 30 rows: the viewer filters
+ * `body` with a contains-match, which a pattern containing `<num>` would
+ * never satisfy.
+ *
+ * The subtlety is that a pattern is NOT a substring of the body it came
+ * from, even between placeholders. The last normalization rule collapses
+ * `\s+` to a single space, so any run spanning a line break in the original
+ * — every stack trace — reads `is null at com.example.Service.process(` in
+ * the pattern where the body has `is null\n\tat com.example...`. Handing
+ * that to `body ILIKE '%...%'` matches nothing, landing the user on an
+ * empty list: the precise failure this function exists to avoid.
+ *
+ * So the candidates are ranked longest-first and the first SAFE one wins:
+ *
+ *  - a whitespace-free token is always safe, because there was no
+ *    whitespace inside it to collapse;
+ *  - a longer multi-word run is used only when `sampleBody` proves it
+ *    survived the collapse verbatim.
+ *
+ * Returns "" when nothing usable survives (an all-placeholder pattern, or
+ * runs too short to be selective), which callers read as "no body filter"
+ * rather than as a filter matching everything.
+ */
+export function getErrorPatternSearchText(
+  pattern: string | undefined | null,
+  options: ErrorPatternSearchTextOptions | number = {},
+): string {
+  /*
+   * Number form kept for the original `(pattern, minimumLength)` callers.
+   */
+  const resolved: ErrorPatternSearchTextOptions =
+    typeof options === "number" ? { minimumLength: options } : options;
+
+  const minimumLength: number = resolved.minimumLength ?? 4;
+  const sampleBody: string =
+    typeof resolved.sampleBody === "string" ? resolved.sampleBody : "";
+
+  if (typeof pattern !== "string" || pattern.length === 0) {
+    return "";
+  }
+
+  const candidates: Array<string> = [];
+
+  for (const segment of pattern.split(PLACEHOLDER_TOKEN)) {
+    const run: string = segment.replace(LEADING_GLUE, "").trim();
+
+    if (run.length > 0) {
+      // The multi-word run: strongest, but only safe when verified.
+      candidates.push(run);
+    }
+
+    /*
+     * ...and every whitespace-free token inside it, which needs no
+     * verification at all.
+     */
+    for (const token of segment.split(WHITESPACE_RUN)) {
+      const trimmed: string = token.replace(LEADING_GLUE, "").trim();
+
+      if (trimmed.length > 0) {
+        candidates.push(trimmed);
+      }
+    }
+  }
+
+  candidates.sort((a: string, b: string): number => {
+    return b.length - a.length;
+  });
+
+  for (const candidate of candidates) {
+    if (candidate.length < minimumLength) {
+      // Sorted longest-first, so everything after this is too short too.
+      break;
+    }
+
+    const isSingleToken: boolean = !ANY_WHITESPACE.test(candidate);
+
+    if (isSingleToken) {
+      return candidate;
+    }
+
+    if (sampleBody.length > 0 && sampleBody.includes(candidate)) {
+      return candidate;
+    }
+  }
+
+  return "";
+}
+
+/**
+ * A short, single-line label for a pattern, for list rows and chips.
+ * Truncation is by characters with an ellipsis; the full pattern stays
+ * available for tooltips and for the detail panel.
+ */
+export function truncateErrorPattern(
+  pattern: string | undefined | null,
+  maxLength: number,
+): string {
+  if (typeof pattern !== "string") {
+    return "";
+  }
+
+  const collapsed: string = pattern.replace(/\s+/g, " ").trim();
+
+  if (maxLength <= 0 || collapsed.length <= maxLength) {
+    return collapsed;
+  }
+
+  return `${collapsed.slice(0, maxLength).trim()}...`;
+}

package/build/dist/Models/AnalyticsModels/Index.js

@@ -1,4 +1,5 @@
 import Log from "./Log";
+import SecurityEvent from "./SecurityEvent";
 import Metric from "./Metric";
 import MetricItemAggMV1m from "./MetricItemAggMV1m";
 import MetricItemAggMV1mByHostV2 from "./MetricItemAggMV1mByHostV2";
@@ -6,6 +7,8 @@ import MetricItemAggMV1mByService from "./MetricItemAggMV1mByService";
 import MetricItemAggMV1mByK8sCluster from "./MetricItemAggMV1mByK8sCluster";
 import MetricItemAggMV1mByContainer from "./MetricItemAggMV1mByContainer";
 import MetricBaselineHourly from "./MetricBaselineHourly";
+import SpanCountBaseline from "./SpanCountBaseline";
+import LogCountBaseline from "./LogCountBaseline";
 import SloHistory from "./SloHistory";
 import Span from "./Span";
 import ExceptionInstance from "./ExceptionInstance";
@@ -41,6 +44,12 @@ const AnalyticsModels = [
     MetricItemAggMV1mByK8sCluster,
     MetricItemAggMV1mByContainer,
     MetricBaselineHourly,
+    /*
+     * Hour-of-week volume baselines for span/log count anomaly criteria.
+     * AggregatingMergeTree targets populated by MVs on Span/Log inserts.
+     */
+    SpanCountBaseline,
+    LogCountBaseline,
     SloHistory,
     ExceptionInstance,
     MonitorLog,
@@ -57,6 +66,7 @@ const AnalyticsModels = [
     RumSession,
     RumSessionChunk,
     AuditLog,
+    SecurityEvent,
 ];
 const modelTypeMap = {};
 export const getModelTypeByName = (tableName) => {

package/build/dist/Models/AnalyticsModels/Index.js.map

@@ -1 +1 @@
-{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../../../Models/AnalyticsModels/Index.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,yBAAyB,MAAM,6BAA6B,CAAC;AACpE,OAAO,0BAA0B,MAAM,8BAA8B,CAAC;AACtE,OAAO,6BAA6B,MAAM,iCAAiC,CAAC;AAC5E,OAAO,4BAA4B,MAAM,gCAAgC,CAAC;AAC1E,OAAO,oBAAoB,MAAM,wBAAwB,CAAC;AAC1D,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC1B,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,wBAAwB,MAAM,4BAA4B,CAAC;AAClE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,QAAQ,MAAM,YAAY,CAAC;AAElC,MAAM,eAAe,GAA0C;IAC7D,GAAG;IACH,IAAI;IACJ,MAAM;IACN;;;OAGG;IACH,iBAAiB;IACjB;;;;OAIG;IACH,yBAAyB;IACzB;;;;OAIG;IACH,0BAA0B;IAC1B,6BAA6B;IAC7B,4BAA4B;IAC5B,oBAAoB;IACpB,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,WAAW;IACX,wBAAwB;IACxB,OAAO;IACP,aAAa;IACb;;;;;OAKG;IACH,UAAU;IACV,eAAe;IACf,QAAQ;CACT,CAAC;AAEF,MAAM,YAAY,GAAsD,EAAE,CAAC;AAM3E,MAAM,CAAC,MAAM,kBAAkB,GAAuB,CACpD,SAAiB,EACsB,EAAE;IACzC,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,GACb,eAAe,CAAC,IAAI,CAAC,CAAC,SAAyC,EAAE,EAAE;QACjE,OAAO,IAAI,SAAS,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;IACjD,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAEpC,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}
+{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../../../Models/AnalyticsModels/Index.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,yBAAyB,MAAM,6BAA6B,CAAC;AACpE,OAAO,0BAA0B,MAAM,8BAA8B,CAAC;AACtE,OAAO,6BAA6B,MAAM,iCAAiC,CAAC;AAC5E,OAAO,4BAA4B,MAAM,gCAAgC,CAAC;AAC1E,OAAO,oBAAoB,MAAM,wBAAwB,CAAC;AAC1D,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC1B,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,wBAAwB,MAAM,4BAA4B,CAAC;AAClE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,QAAQ,MAAM,YAAY,CAAC;AAElC,MAAM,eAAe,GAA0C;IAC7D,GAAG;IACH,IAAI;IACJ,MAAM;IACN;;;OAGG;IACH,iBAAiB;IACjB;;;;OAIG;IACH,yBAAyB;IACzB;;;;OAIG;IACH,0BAA0B;IAC1B,6BAA6B;IAC7B,4BAA4B;IAC5B,oBAAoB;IACpB;;;OAGG;IACH,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,WAAW;IACX,wBAAwB;IACxB,OAAO;IACP,aAAa;IACb;;;;;OAKG;IACH,UAAU;IACV,eAAe;IACf,QAAQ;IACR,aAAa;CACd,CAAC;AAEF,MAAM,YAAY,GAAsD,EAAE,CAAC;AAM3E,MAAM,CAAC,MAAM,kBAAkB,GAAuB,CACpD,SAAiB,EACsB,EAAE;IACzC,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,GACb,eAAe,CAAC,IAAI,CAAC,CAAC,SAAyC,EAAE,EAAE;QACjE,OAAO,IAAI,SAAS,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;IACjD,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAEpC,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/build/dist/Models/AnalyticsModels/LogCountBaseline.js

@@ -0,0 +1,159 @@
+import AnalyticsBaseModel from "./AnalyticsBaseModel/AnalyticsBaseModel";
+import AnalyticsTableEngine from "../../Types/AnalyticsDatabase/AnalyticsTableEngine";
+import AnalyticsTableName from "../../Types/AnalyticsDatabase/AnalyticsTableName";
+import AnalyticsTableColumn from "../../Types/AnalyticsDatabase/TableColumn";
+import TableColumnType from "../../Types/AnalyticsDatabase/TableColumnType";
+/**
+ * Per-(day, hour-of-week, minute-of-hour) log-volume baseline —
+ * backbone of log-count anomaly detection for Logs monitors. Peer of
+ * `SpanCountBaseline` (see that model for the full rationale on the
+ * minute-of-hour sub-bucket, cold start and read semantics) and of
+ * `MetricBaselineHourly` for count-shaped telemetry.
+ *
+ * Populated by `LogCountBaseline_mv`, which fires on every insert into
+ * `LogItemV3` and groups by `(projectId, primaryEntityId, severityText,
+ * day, hourOfWeek, minuteOfHour)`. Each row holds a single
+ * AggregateFunction(count) state — finalize via `countMerge()`.
+ *
+ * `severityText` is part of the key so a monitor scoped to Error/Fatal
+ * logs baselines error volume only — not total log traffic. Read-side
+ * queries that don't filter on it merge across the values.
+ *
+ * Read access goes through `LogCountBaselineService`. No CRUD API is
+ * exposed; this is read-only baseline storage.
+ */
+export default class LogCountBaseline extends AnalyticsBaseModel {
+    constructor() {
+        const projectIdColumn = new AnalyticsTableColumn({
+            key: "projectId",
+            title: "Project ID",
+            description: "ID of project (tenant key, replicated from LogItemV3)",
+            required: true,
+            type: TableColumnType.Text,
+            isTenantId: true,
+        });
+        const primaryEntityIdColumn = new AnalyticsTableColumn({
+            key: "primaryEntityId",
+            title: "Service ID",
+            description: "Telemetry service the logs belong to (replicated from LogItemV3)",
+            required: true,
+            type: TableColumnType.Text,
+        });
+        const severityTextColumn = new AnalyticsTableColumn({
+            key: "severityText",
+            title: "Severity Text",
+            description: "Log severity (Information, Error, ...). In the key so error-scoped monitors baseline error volume only.",
+            required: true,
+            type: TableColumnType.Text,
+            isLowCardinality: true,
+        });
+        const dayColumn = new AnalyticsTableColumn({
+            key: "day",
+            title: "Day",
+            description: "Calendar day this row aggregates (toDate(time)). Drives the table TTL of 90 days.",
+            required: true,
+            type: TableColumnType.Date,
+        });
+        const hourOfWeekColumn = new AnalyticsTableColumn({
+            key: "hourOfWeek",
+            title: "Hour Of Week",
+            description: "(toDayOfWeek(time, 1) - 1) * 24 + toHour(time). Range 0..167 with Mon 00:00 = 0.",
+            required: true,
+            type: TableColumnType.UInt8,
+        });
+        const minuteOfHourColumn = new AnalyticsTableColumn({
+            key: "minuteOfHour",
+            title: "Minute Of Hour",
+            description: "toMinute(time), 0..59. One cell per minute — a per-minute log count is the baseline's raw sample.",
+            required: true,
+            type: TableColumnType.UInt8,
+        });
+        const logCountStateColumn = new AnalyticsTableColumn({
+            key: "logCountState",
+            title: "Log Count (state)",
+            description: "AggregateFunction(count) state — logs in this minute cell. Read via countMerge(logCountState).",
+            required: true,
+            type: TableColumnType.AggregateFunction,
+            aggregateFunctionDefinition: "count",
+        });
+        super({
+            tableName: AnalyticsTableName.LogCountBaseline,
+            tableEngine: AnalyticsTableEngine.AggregatingMergeTree,
+            singularName: "Log Count Baseline",
+            pluralName: "Log Count Baselines",
+            tableColumns: [
+                projectIdColumn,
+                primaryEntityIdColumn,
+                severityTextColumn,
+                dayColumn,
+                hourOfWeekColumn,
+                minuteOfHourColumn,
+                logCountStateColumn,
+            ],
+            projections: [],
+            /*
+             * Baseline materialized view. Canonical definition applied
+             * idempotently by the analytics schema-sync on every boot (see
+             * AnalyticsTableManagement.createMaterializedViews), so a
+             * wiped/recreated ClickHouse volume self-heals. Counts each log
+             * into its (day, hour-of-week, minute-of-hour, severity) cell.
+             */
+            materializedViews: [
+                {
+                    name: "LogCountBaseline_mv",
+                    query: `CREATE MATERIALIZED VIEW IF NOT EXISTS LogCountBaseline_mv
+TO LogCountBaseline
+AS
+SELECT
+  projectId,
+  primaryEntityId,
+  severityText,
+  toDate(time) AS day,
+  toUInt8((toDayOfWeek(time, 1) - 1) * 24 + toHour(time)) AS hourOfWeek,
+  toUInt8(toMinute(time)) AS minuteOfHour,
+  countState() AS logCountState
+FROM LogItemV3
+GROUP BY projectId, primaryEntityId, severityText, day, hourOfWeek, minuteOfHour`,
+                },
+            ],
+            /*
+             * Sort key prefix matches the read-side WHERE clause of
+             * LogCountBaselineService.getBaseline (project → service →
+             * hourOfWeek → day range) so lookups touch a tight granule range.
+             * severityText sits last: most reads merge across it.
+             */
+            sortKeys: [
+                "projectId",
+                "primaryEntityId",
+                "hourOfWeek",
+                "day",
+                "minuteOfHour",
+                "severityText",
+            ],
+            primaryKeys: [
+                "projectId",
+                "primaryEntityId",
+                "hourOfWeek",
+                "day",
+                "minuteOfHour",
+                "severityText",
+            ],
+            partitionKey: "toYYYYMM(day)",
+            /*
+             * Shard by (project, service) so each service's baseline states
+             * stay on a single shard and countMerge folds locally.
+             */
+            shardingKey: "cityHash64(projectId, primaryEntityId)",
+            tableSettings: "ttl_only_drop_parts = 1, non_replicated_deduplication_window = 10000",
+            /*
+             * Locked to MetricBaselineService.MAX_WINDOW_DAYS (90) — the
+             * longest baseline window the criteria form offers. Bump both
+             * together or reads will silently truncate caller intent.
+             */
+            ttlExpression: "day + INTERVAL 90 DAY",
+            includeBaseColumns: false,
+            defaultSortColumn: "day",
+        });
+    }
+}
+//# sourceMappingURL=LogCountBaseline.js.map

package/build/dist/Models/AnalyticsModels/LogCountBaseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LogCountBaseline.js","sourceRoot":"","sources":["../../../../Models/AnalyticsModels/LogCountBaseline.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,MAAM,yCAAyC,CAAC;AACzE,OAAO,oBAAoB,MAAM,oDAAoD,CAAC;AACtF,OAAO,kBAAkB,MAAM,kDAAkD,CAAC;AAClF,OAAO,oBAAoB,MAAM,2CAA2C,CAAC;AAC7E,OAAO,eAAe,MAAM,+CAA+C,CAAC;AAE5E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,kBAAkB;IAC9D;QACE,MAAM,eAAe,GAAyB,IAAI,oBAAoB,CAAC;YACrE,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,uDAAuD;YACpE,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,qBAAqB,GACzB,IAAI,oBAAoB,CAAC;YACvB,GAAG,EAAE,iBAAiB;YACtB,KAAK,EAAE,YAAY;YACnB,WAAW,EACT,kEAAkE;YACpE,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe,CAAC,IAAI;SAC3B,CAAC,CAAC;QAEL,MAAM,kBAAkB,GAAyB,IAAI,oBAAoB,CAAC;YACxE,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,eAAe;YACtB,WAAW,EACT,yGAAyG;YAC3G,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAyB,IAAI,oBAAoB,CAAC;YAC/D,GAAG,EAAE,KAAK;YACV,KAAK,EAAE,KAAK;YACZ,WAAW,EACT,mFAAmF;YACrF,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe,CAAC,IAAI;SAC3B,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAyB,IAAI,oBAAoB,CAAC;YACtE,GAAG,EAAE,YAAY;YACjB,KAAK,EAAE,cAAc;YACrB,WAAW,EACT,kFAAkF;YACpF,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe,CAAC,KAAK;SAC5B,CAAC,CAAC;QAEH,MAAM,kBAAkB,GAAyB,IAAI,oBAAoB,CAAC;YACxE,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACT,mGAAmG;YACrG,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe,CAAC,KAAK;SAC5B,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAyB,IAAI,oBAAoB,CAAC;YACzE,GAAG,EAAE,eAAe;YACpB,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACT,gGAAgG;YAClG,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe,CAAC,iBAAiB;YACvC,2BAA2B,EAAE,OAAO;SACrC,CAAC,CAAC;QAEH,KAAK,CAAC;YACJ,SAAS,EAAE,kBAAkB,CAAC,gBAAgB;YAC9C,WAAW,EAAE,oBAAoB,CAAC,oBAAoB;YACtD,YAAY,EAAE,oBAAoB;YAClC,UAAU,EAAE,qBAAqB;YACjC,YAAY,EAAE;gBACZ,eAAe;gBACf,qBAAqB;gBACrB,kBAAkB;gBAClB,SAAS;gBACT,gBAAgB;gBAChB,kBAAkB;gBAClB,mBAAmB;aACpB;YACD,WAAW,EAAE,EAAE;YACf;;;;;;eAMG;YACH,iBAAiB,EAAE;gBACjB;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,KAAK,EAAE;;;;;;;;;;;;iFAYgE;iBACxE;aACF;YACD;;;;;eAKG;YACH,QAAQ,EAAE;gBACR,WAAW;gBACX,iBAAiB;gBACjB,YAAY;gBACZ,KAAK;gBACL,cAAc;gBACd,cAAc;aACf;YACD,WAAW,EAAE;gBACX,WAAW;gBACX,iBAAiB;gBACjB,YAAY;gBACZ,KAAK;gBACL,cAAc;gBACd,cAAc;aACf;YACD,YAAY,EAAE,eAAe;YAC7B;;;eAGG;YACH,WAAW,EAAE,wCAAwC;YACrD,aAAa,EACX,sEAAsE;YACxE;;;;eAIG;YACH,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,KAAK;YACzB,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC;IACL,CAAC;CACF"}