@oneuptime/common 12.0.24 → 12.0.26

package/Types/Log/LogQueryToFilter.ts

@@ -1,31 +1,37 @@
 /**
- * Converts parsed log query tokens into a Query<Log> object compatible with
- * the AnalyticsDatabaseService query system.
+ * Compiles the log search bar's query string into a `Query<Log>` for the
+ * AnalyticsDatabaseService.
+ *
+ * The grammar itself lives in `Common/Types/Telemetry/TelemetrySearchQuery` —
+ * shared with traces, metrics and exceptions, so `@platform.team:a*` means the
+ * same thing on every explorer. Everything here is log-specific: which names
+ * are columns, which alias to what, and how severity is spelled in the data.
  */
 
-import {
-  ParsedToken,
-  TokenType,
-  FilterOperator,
-  parseLogQuery,
-} from "./LogQueryParser";
 import Search from "../BaseDatabase/Search";
-import NotEqual from "../BaseDatabase/NotEqual";
-import GreaterThan from "../BaseDatabase/GreaterThan";
-import GreaterThanOrEqual from "../BaseDatabase/GreaterThanOrEqual";
-import LessThan from "../BaseDatabase/LessThan";
-import LessThanOrEqual from "../BaseDatabase/LessThanOrEqual";
+import {
+  SearchToken,
+  SearchTokenType,
+  SearchValueOperator,
+  SearchQueryValue,
+  parseSearchQuery,
+  predicateToQueryValue,
+} from "../Telemetry/TelemetrySearchQuery";
 
 export interface LogFilter {
-  body?: string | Search<string>;
-  severityText?: string;
-  primaryEntityId?: string;
-  traceId?: string;
-  spanId?: string;
+  body?: string | Search<string> | Array<unknown>;
+  severityText?: unknown;
+  primaryEntityId?: unknown;
+  traceId?: unknown;
+  spanId?: unknown;
   attributes?: Record<string, unknown>;
   [key: string]: unknown;
 }
 
+/**
+ * Columns a bare `field:value` token can address. Anything else is treated as
+ * an attribute, which is what makes `k8s.pod:foo` work without an `@`.
+ */
 const TOP_LEVEL_FIELDS: Set<string> = new Set([
   "severityText",
   "primaryEntityId",
@@ -34,9 +40,34 @@ const TOP_LEVEL_FIELDS: Set<string> = new Set([
   "body",
 ]);
 
+export const LOG_FIELD_ALIASES: Record<string, string> = {
+  severity: "severityText",
+  severitytext: "severityText",
+  level: "severityText",
+  service: "primaryEntityId",
+  primaryentityid: "primaryEntityId",
+  trace: "traceId",
+  traceid: "traceId",
+  span: "spanId",
+  spanid: "spanId",
+  message: "body",
+  msg: "body",
+  log: "body",
+  body: "body",
+};
+
+/**
+ * Field names that may be followed by a space before their value
+ * (`severity: error`). Kept to known names so ordinary prose containing a
+ * colon stays free text rather than becoming a filter on an invented field.
+ */
+export const LOG_KNOWN_FIELD_KEYS: Set<string> = new Set(
+  Object.keys(LOG_FIELD_ALIASES),
+);
+
 /*
- * Severity values stored in the database use title case (e.g. "Error", "Debug").
- * Normalise user input so that "error" matches "Error", etc.
+ * Severity values stored in the database use title case (e.g. "Error",
+ * "Debug"). Normalise user input so that "error" matches "Error".
  */
 const SEVERITY_CANONICAL: Record<string, string> = {
   fatal: "Fatal",
@@ -50,138 +81,145 @@ const SEVERITY_CANONICAL: Record<string, string> = {
   unspecified: "Unspecified",
 };
 
-function normalizeSeverityValue(value: string): string {
+type NormalizeSeverityValueFunction = (value: string) => string;
+
+const normalizeSeverityValue: NormalizeSeverityValueFunction = (
+  value: string,
+): string => {
   return SEVERITY_CANONICAL[value.toLowerCase()] || value;
-}
+};
 
-function applyFieldFilter(filter: LogFilter, token: ParsedToken): void {
-  if (!token.field) {
-    return;
+type CanonicalizeTokenFunction = (token: SearchToken) => SearchToken;
+
+/*
+ * Severity is an enum spelled in title case in ClickHouse, and users type it
+ * however they like. Canonicalising here — on the predicate, before it is
+ * compiled — means the normalisation applies to every operator, not just
+ * equality: `severity:(error OR warn)` and `-severity:debug` get it too.
+ */
+const canonicalizeToken: CanonicalizeTokenFunction = (
+  token: SearchToken,
+): SearchToken => {
+  if (token.key !== "severityText") {
+    return token;
   }
 
-  let value: string = token.value;
+  return {
+    ...token,
+    predicate: {
+      ...token.predicate,
+      value: normalizeSeverityValue(token.predicate.value),
+      values: token.predicate.values.map(normalizeSeverityValue),
+    },
+  };
+};
 
-  // Normalise severity values to match database casing
-  if (token.field === "severityText") {
-    value = normalizeSeverityValue(value);
-  }
+type AssignFunction = (
+  target: Record<string, unknown>,
+  key: string,
+  value: unknown,
+) => void;
 
-  if (TOP_LEVEL_FIELDS.has(token.field)) {
-    applyTopLevelFilter(filter, token.field, value, token.operator);
-  } else {
-    applyAttributeFilter(filter, token.field, value, token.operator);
+/*
+ * Two filters on one key AND together rather than the second overwriting the
+ * first — `@k:a* @k:*b` is "starts with a and ends with b". The compilers
+ * accept an array of operators on a column and on a map sub-key and compile
+ * each one; a bare string cannot join such an array, so the first wins in
+ * that case (a plain equality already pins the value).
+ */
+const assign: AssignFunction = (
+  target: Record<string, unknown>,
+  key: string,
+  value: unknown,
+): void => {
+  const existing: unknown = target[key];
+
+  if (existing === undefined) {
+    target[key] = value;
+    return;
   }
-}
 
-function applyTopLevelFilter(
-  filter: LogFilter,
-  field: string,
-  value: string,
-  operator: FilterOperator,
-): void {
-  switch (operator) {
-    case FilterOperator.Contains:
-    case FilterOperator.Wildcard:
-      filter[field] = new Search(value.replace(/\*/g, ""));
-      break;
-    case FilterOperator.GreaterThan:
-      filter[field] = new GreaterThan(parseNumericOrString(value));
-      break;
-    case FilterOperator.GreaterThanOrEqual:
-      filter[field] = new GreaterThanOrEqual(parseNumericOrString(value));
-      break;
-    case FilterOperator.LessThan:
-      filter[field] = new LessThan(parseNumericOrString(value));
-      break;
-    case FilterOperator.LessThanOrEqual:
-      filter[field] = new LessThanOrEqual(parseNumericOrString(value));
-      break;
-    case FilterOperator.NotEquals:
-      filter[field] = new NotEqual(value);
-      break;
-    case FilterOperator.Equals:
-    default:
-      filter[field] = value;
-      break;
+  if (typeof existing === "string" || typeof value === "string") {
+    return;
   }
-}
 
-function applyAttributeFilter(
-  filter: LogFilter,
-  field: string,
-  value: string,
-  operator: FilterOperator,
-): void {
-  if (!filter.attributes) {
-    filter.attributes = {};
-  }
+  target[key] = Array.isArray(existing)
+    ? [...existing, value]
+    : [existing, value];
+};
 
-  switch (operator) {
-    case FilterOperator.Contains:
-    case FilterOperator.Wildcard:
-      filter.attributes[field] = new Search(value.replace(/\*/g, ""));
-      break;
-    case FilterOperator.NotEquals:
-      filter.attributes[field] = new NotEqual(value);
-      break;
-    case FilterOperator.GreaterThan:
-      filter.attributes[field] = new GreaterThan(parseNumericOrString(value));
-      break;
-    case FilterOperator.GreaterThanOrEqual:
-      filter.attributes[field] = new GreaterThanOrEqual(
-        parseNumericOrString(value),
-      );
-      break;
-    case FilterOperator.LessThan:
-      filter.attributes[field] = new LessThan(parseNumericOrString(value));
-      break;
-    case FilterOperator.LessThanOrEqual:
-      filter.attributes[field] = new LessThanOrEqual(
-        parseNumericOrString(value),
-      );
-      break;
-    case FilterOperator.Equals:
-    default:
-      filter.attributes[field] = value;
-      break;
-  }
-}
+type ApplyFreeTextFunction = (filter: LogFilter, phrase: string) => void;
 
-function applyFreeTextFilter(filter: LogFilter, token: ParsedToken): void {
-  if (filter.body && filter.body instanceof Search) {
-    const existing: string = filter.body.toString();
-    filter.body = new Search(`${existing} ${token.value}`);
-  } else if (filter.body && typeof filter.body === "string") {
-    filter.body = new Search(`${filter.body} ${token.value}`);
-  } else {
-    filter.body = new Search(token.value);
+/*
+ * Each free-text phrase is its own contains-predicate on the body. They are
+ * NOT concatenated: `foo severity:error bar` means "the line mentions foo and
+ * mentions bar", never the phrase "foo bar", which never occurred in any log
+ * line and matched nothing.
+ */
+const applyFreeText: ApplyFreeTextFunction = (
+  filter: LogFilter,
+  phrase: string,
+): void => {
+  if (phrase.trim().length === 0) {
+    return;
   }
-}
 
-function parseNumericOrString(value: string): number | string {
-  const num: number = Number(value);
-  return isNaN(num) ? value : num;
-}
+  assign(filter as Record<string, unknown>, "body", new Search(phrase));
+};
 
 export function queryStringToFilter(queryString: string): LogFilter {
-  const tokens: Array<ParsedToken> = parseLogQuery(queryString);
+  const tokens: Array<SearchToken> = parseSearchQuery(queryString, {
+    knownFieldKeys: LOG_KNOWN_FIELD_KEYS,
+    fieldAliases: LOG_FIELD_ALIASES,
+  });
+
   const filter: LogFilter = {};
 
   for (const token of tokens) {
-    switch (token.type) {
-      case TokenType.FreeText:
-        applyFreeTextFilter(filter, token);
-        break;
-      case TokenType.FieldFilter:
-        applyFieldFilter(filter, token);
-        break;
-      case TokenType.AttributeFilter:
-        applyFieldFilter(filter, token);
-        break;
+    if (token.type === SearchTokenType.FreeText) {
+      applyFreeText(filter, token.predicate.value);
+      continue;
+    }
+
+    const canonical: SearchToken = canonicalizeToken(token);
+    const compiled: SearchQueryValue = predicateToQueryValue(
+      canonical.predicate,
+    );
+
+    /*
+     * An `@`-prefixed token is ALWAYS an attribute, even when the key happens
+     * to spell a column name. `@body:x` used to filter the body column and
+     * `@traceId:x` the traceId column, silently ignoring the `@` that says
+     * "look in the attributes map".
+     */
+    if (
+      canonical.type === SearchTokenType.Field &&
+      TOP_LEVEL_FIELDS.has(canonical.key)
+    ) {
+      assign(filter as Record<string, unknown>, canonical.key, compiled);
+      continue;
+    }
+
+    if (!filter.attributes) {
+      filter.attributes = {};
     }
+
+    assign(filter.attributes, canonical.key, compiled);
   }
 
   return filter;
 }
 
+/**
+ * Does this query string carry any filter at all?
+ *
+ * Used by callers that need to tell "the user typed nothing" from "the user
+ * typed something that parsed to nothing".
+ */
+export function isEmptyLogQuery(queryString: string): boolean {
+  return parseSearchQuery(queryString).length === 0;
+}
+
+export { SearchValueOperator };
+
 export default queryStringToFilter;

package/Types/Monitor/DockerAlertTemplates.ts

@@ -30,6 +30,22 @@ export interface DockerAlertTemplate {
   getMonitorStep: (args: DockerAlertTemplateArgs) => MonitorStep;
 }
 
+/*
+ * Filter contract: the Docker agent stamps container identity as OTLP
+ * RESOURCE attributes, so ClickHouse stores them `resource.`-prefixed:
+ * `resource.container.name`, `resource.container.image.name`,
+ * `resource.container.runtime` ("docker") and `resource.host.name`. The
+ * worker adds the host scope (`resource.host.name` from hostIdentifier)
+ * and the runtime filter itself. Every template groups by
+ * `resource.container.name` so each container on the host is evaluated
+ * independently — one incident per container instead of one incident for
+ * the whole host, where the busiest container silences every other one.
+ *
+ * NOTE: this is `resource.`-prefixed, unlike Docker Swarm, whose
+ * docker_stats receiver keeps container identity in DATAPOINT labels
+ * (plain `container.name`).
+ */
+
 export function buildDockerMonitorStep(args: {
   dockerMonitor: MonitorStepDockerMonitor;
   offlineCriteriaInstance: MonitorCriteriaInstance;
@@ -184,6 +200,7 @@ export function buildDockerMonitorConfig(args: {
   rollingTime: RollingTime;
   aggregationType: MetricsAggregationType;
   attributes?: Record<string, string>;
+  groupByAttributeKey?: string | undefined;
 }): MonitorStepDockerMonitor {
   return {
     hostIdentifier: args.hostIdentifier,
@@ -205,6 +222,9 @@ export function buildDockerMonitorConfig(args: {
               aggegationType: args.aggregationType,
               aggregateBy: {},
             },
+            ...(args.groupByAttributeKey
+              ? { groupByAttributeKeys: [args.groupByAttributeKey] }
+              : {}),
           },
         },
       ],
@@ -219,7 +239,8 @@ export function buildDockerMonitorConfig(args: {
 const highCpuTemplate: DockerAlertTemplate = {
   id: "docker-high-cpu",
   name: "High Container CPU Usage",
-  description: "Alert when container CPU usage exceeds 80% sustained.",
+  description:
+    "Alert when container CPU usage exceeds 80% sustained. One alert per container.",
   category: "Resource",
   severity: "Warning",
   getMonitorStep: (args: DockerAlertTemplateArgs): MonitorStep => {
@@ -232,10 +253,12 @@ const highCpuTemplate: DockerAlertTemplate = {
         metricAlias,
         rollingTime: RollingTime.Past5Minutes,
         /*
-         * Use Max so a single hot container trips the threshold instead of
-         * being diluted by idle containers on the host.
+         * Max WITHIN each container's series: any scrape in the window over
+         * the threshold trips that container. Grouping by container name
+         * already keeps a hot container from being diluted by idle ones.
          */
         aggregationType: MetricsAggregationType.Max,
+        groupByAttributeKey: "resource.container.name",
       }),
       offlineCriteriaInstance: buildDockerOfflineCriteriaInstance({
         offlineMonitorStatusId: args.offlineMonitorStatusId,
@@ -264,7 +287,8 @@ const highCpuTemplate: DockerAlertTemplate = {
 const highMemoryTemplate: DockerAlertTemplate = {
   id: "docker-high-memory",
   name: "High Container Memory Usage",
-  description: "Alert when container memory usage exceeds 85% of its limit.",
+  description:
+    "Alert when container memory usage exceeds 85% of its limit. One alert per container.",
   category: "Resource",
   severity: "Warning",
   getMonitorStep: (args: DockerAlertTemplateArgs): MonitorStep => {
@@ -277,10 +301,12 @@ const highMemoryTemplate: DockerAlertTemplate = {
         metricAlias,
         rollingTime: RollingTime.Past5Minutes,
         /*
-         * Use Max so a single container breaching its limit trips the
-         * threshold instead of being diluted by idle containers.
+         * Max WITHIN each container's series: any scrape in the window over
+         * the limit trips that container. Grouping by container name already
+         * keeps a container at its limit from being diluted by idle ones.
          */
         aggregationType: MetricsAggregationType.Max,
+        groupByAttributeKey: "resource.container.name",
       }),
       offlineCriteriaInstance: buildDockerOfflineCriteriaInstance({
         offlineMonitorStatusId: args.offlineMonitorStatusId,
@@ -310,7 +336,7 @@ const containerRestartLoopTemplate: DockerAlertTemplate = {
   id: "docker-restart-loop",
   name: "Container Restart Loop",
   description:
-    "Alert when a container has restarted more than 5 times, indicating a crash loop.",
+    "Alert when a container has restarted more than 5 times, indicating a crash loop. One alert per container.",
   category: "Container",
   severity: "Critical",
   getMonitorStep: (args: DockerAlertTemplateArgs): MonitorStep => {
@@ -323,6 +349,7 @@ const containerRestartLoopTemplate: DockerAlertTemplate = {
         metricAlias,
         rollingTime: RollingTime.Past5Minutes,
         aggregationType: MetricsAggregationType.Max,
+        groupByAttributeKey: "resource.container.name",
       }),
       offlineCriteriaInstance: buildDockerOfflineCriteriaInstance({
         offlineMonitorStatusId: args.offlineMonitorStatusId,
@@ -352,7 +379,7 @@ const highCpuThrottlingTemplate: DockerAlertTemplate = {
   id: "docker-cpu-throttling",
   name: "Container CPU Throttling",
   description:
-    "Alert when a container is being CPU-throttled, indicating it needs more CPU resources.",
+    "Alert when a container is being CPU-throttled, indicating it needs more CPU resources. One alert per container.",
   category: "Resource",
   severity: "Warning",
   getMonitorStep: (args: DockerAlertTemplateArgs): MonitorStep => {
@@ -365,10 +392,12 @@ const highCpuThrottlingTemplate: DockerAlertTemplate = {
         metricAlias,
         rollingTime: RollingTime.Past5Minutes,
         /*
-         * Use Max so a single throttled container trips the threshold,
-         * rather than summing throttled time across all containers.
+         * Max WITHIN each container's series, so throttled time is never
+         * summed across containers — grouping by container name attributes
+         * the throttling to the container that actually suffered it.
          */
         aggregationType: MetricsAggregationType.Max,
+        groupByAttributeKey: "resource.container.name",
       }),
       offlineCriteriaInstance: buildDockerOfflineCriteriaInstance({
         offlineMonitorStatusId: args.offlineMonitorStatusId,
@@ -398,7 +427,7 @@ const highProcessCountTemplate: DockerAlertTemplate = {
   id: "docker-high-pids",
   name: "High Container Process Count",
   description:
-    "Alert when a container has an unusually high number of processes, which may indicate a fork bomb or resource leak.",
+    "Alert when a container has an unusually high number of processes, which may indicate a fork bomb or resource leak. One alert per container.",
   category: "Container",
   severity: "Warning",
   getMonitorStep: (args: DockerAlertTemplateArgs): MonitorStep => {
@@ -411,6 +440,7 @@ const highProcessCountTemplate: DockerAlertTemplate = {
         metricAlias,
         rollingTime: RollingTime.Past5Minutes,
         aggregationType: MetricsAggregationType.Max,
+        groupByAttributeKey: "resource.container.name",
       }),
       offlineCriteriaInstance: buildDockerOfflineCriteriaInstance({
         offlineMonitorStatusId: args.offlineMonitorStatusId,
@@ -440,7 +470,7 @@ const containerUptimeTemplate: DockerAlertTemplate = {
   id: "docker-container-down",
   name: "Container Down (Low Uptime)",
   description:
-    "Alert when a container's uptime drops to zero, indicating it has stopped or crashed.",
+    "Alert when a container's uptime drops to zero, indicating it has stopped or crashed. One alert per container.",
   category: "Container",
   severity: "Critical",
   getMonitorStep: (args: DockerAlertTemplateArgs): MonitorStep => {
@@ -453,6 +483,7 @@ const containerUptimeTemplate: DockerAlertTemplate = {
         metricAlias,
         rollingTime: RollingTime.Past1Minute,
         aggregationType: MetricsAggregationType.Min,
+        groupByAttributeKey: "resource.container.name",
       }),
       offlineCriteriaInstance: buildDockerOfflineCriteriaInstance({
         offlineMonitorStatusId: args.offlineMonitorStatusId,

package/Types/Monitor/HostAlertTemplates.ts

@@ -30,6 +30,25 @@ export interface HostAlertTemplate {
   getMonitorStep: (args: HostAlertTemplateArgs) => MonitorStep;
 }
 
+/*
+ * Filter contract: a host monitor is already scoped to ONE host — the
+ * worker adds `resource.host.name` from the step's hostIdentifier — so
+ * host-scalar metrics (CPU utilization, memory utilization, load average,
+ * process count) stay UNGROUPED: there is exactly one series per host and
+ * grouping would buy nothing.
+ *
+ * Metrics that are per-entity WITHIN the host are grouped, because the
+ * hostmetrics receiver partitions them by unprefixed DATAPOINT labels
+ * (never `resource.`-prefixed):
+ *
+ *   - `system.filesystem.*` -> `mountpoint` (also `device`, `state`)
+ *   - `system.disk.*` / `system.network.*` -> `device` (also `direction`)
+ *
+ * Without a group-by, one full mount raises a single incident for the
+ * whole host and every other mount that fills up afterwards is silenced
+ * for as long as that incident stays open.
+ */
+
 export function buildHostMonitorStep(args: {
   hostMonitor: MonitorStepHostMonitor;
   offlineCriteriaInstance: MonitorCriteriaInstance;
@@ -184,6 +203,7 @@ export function buildHostMonitorConfig(args: {
   rollingTime: RollingTime;
   aggregationType: MetricsAggregationType;
   attributes?: Record<string, string>;
+  groupByAttributeKey?: string | undefined;
 }): MonitorStepHostMonitor {
   return {
     hostIdentifier: args.hostIdentifier,
@@ -204,6 +224,9 @@ export function buildHostMonitorConfig(args: {
               aggegationType: args.aggregationType,
               aggregateBy: {},
             },
+            ...(args.groupByAttributeKey
+              ? { groupByAttributeKeys: [args.groupByAttributeKey] }
+              : {}),
           },
         },
       ],
@@ -302,7 +325,8 @@ const highMemoryTemplate: HostAlertTemplate = {
 const highFilesystemUsageTemplate: HostAlertTemplate = {
   id: "host-high-filesystem",
   name: "High Filesystem Usage",
-  description: "Alert when host filesystem utilization exceeds 90%.",
+  description:
+    "Alert when host filesystem utilization exceeds 90%. One alert per mountpoint.",
   category: "Resource",
   severity: "Critical",
   getMonitorStep: (args: HostAlertTemplateArgs): MonitorStep => {
@@ -315,10 +339,14 @@ const highFilesystemUsageTemplate: HostAlertTemplate = {
         metricAlias,
         rollingTime: RollingTime.Past5Minutes,
         /*
-         * Use Max so a single full filesystem trips the threshold instead of
-         * being diluted by averaging across multiple mounted filesystems.
+         * Max WITHIN each mountpoint's series: the peak utilization that
+         * mount reached during the window. Grouping by `mountpoint` already
+         * keeps mounts from being averaged together, and gives one incident
+         * per mount so a second mount filling up is not silenced by the
+         * first one's open incident.
          */
         aggregationType: MetricsAggregationType.Max,
+        groupByAttributeKey: "mountpoint",
       }),
       offlineCriteriaInstance: buildHostOfflineCriteriaInstance({
         offlineMonitorStatusId: args.offlineMonitorStatusId,