lduck 0.0.2 → 0.0.4

package/dist/index.js

@@ -53,9 +53,64 @@ function createApp(scriptSrc, setup) {
   });
   return app;
 }
+const LOG_LEVELS = [
+  "DEBUG",
+  "INFO",
+  "WARN",
+  "ERROR",
+  "FATAL"
+];
+const FIELD_MAPPINGS = {
+  timestamp: ["timestamp", "ts", "time", "@timestamp", "datetime"],
+  level: ["level", "severity", "loglevel", "lvl", "priority"],
+  message: ["message", "msg", "body", "text"],
+  service: ["service", "svc", "app", "component", "logger"],
+  trace_id: ["trace_id", "traceId", "request_id", "correlation_id"]
+};
+const REVERSE_FIELD_MAP = (() => {
+  const map = /* @__PURE__ */ new Map();
+  for (const [canonical, aliases] of Object.entries(FIELD_MAPPINGS)) {
+    for (const alias of aliases) {
+      map.set(alias, canonical);
+    }
+  }
+  return map;
+})();
+function resolveField(fieldName) {
+  return REVERSE_FIELD_MAP.get(fieldName) ?? null;
+}
+function splitLevels(csv) {
+  if (!csv) return void 0;
+  const levels = csv.split(",").filter((v) => LOG_LEVELS.includes(v));
+  return levels.length > 0 ? levels : void 0;
+}
+function splitStrings(csv) {
+  if (!csv) return void 0;
+  const values = csv.split(",").filter(Boolean);
+  return values.length > 0 ? values : void 0;
+}
+function parseJsonFilters(raw) {
+  if (!raw) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+    const result = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (Array.isArray(value)) {
+        result[key] = value.map(String);
+      } else if (typeof value === "string") {
+        result[key] = [value];
+      }
+    }
+    return Object.keys(result).length > 0 ? result : void 0;
+  } catch {
+    return void 0;
+  }
+}
 const logQuerySchema = z.object({
-  level: z.enum(["DEBUG", "INFO", "WARN", "ERROR", "FATAL"]).optional(),
+  level: z.string().optional(),
   service: z.string().optional(),
+  host: z.string().optional(),
   source: z.string().optional(),
   search: z.string().optional(),
   startTime: z.coerce.date().optional(),
@@ -73,7 +128,7 @@ const sqlQuerySchema = z.object({
 });
 const exportSchema = z.object({
   format: z.enum(["csv", "json"]),
-  level: z.enum(["DEBUG", "INFO", "WARN", "ERROR", "FATAL"]).optional(),
+  level: z.string().optional(),
   service: z.string().optional(),
   source: z.string().optional(),
   search: z.string().optional(),
@@ -87,14 +142,26 @@ const ingestBodySchema = z.union([
 const facetQuerySchema = z.object({
   field: z.string(),
   jsonPath: z.string().optional(),
-  level: z.enum(["DEBUG", "INFO", "WARN", "ERROR", "FATAL"]).optional(),
+  level: z.string().optional(),
   service: z.string().optional(),
+  host: z.string().optional(),
   source: z.string().optional(),
   search: z.string().optional(),
   startTime: z.coerce.date().optional(),
   endTime: z.coerce.date().optional(),
   jsonFilters: z.string().optional()
 });
+const histogramQuerySchema = z.object({
+  buckets: z.coerce.number().int().min(1).max(360).default(30),
+  startTime: z.coerce.date().optional(),
+  endTime: z.coerce.date().optional(),
+  level: z.string().optional(),
+  service: z.string().optional(),
+  host: z.string().optional(),
+  source: z.string().optional(),
+  search: z.string().optional(),
+  jsonFilters: z.string().optional()
+});
 function validationHook(result, c) {
   if (!result.success) {
     return c.json(
@@ -132,7 +199,8 @@ function serializeStats$1(stats) {
     timeRange: {
       min: stats.timeRange.min?.toISOString() ?? null,
       max: stats.timeRange.max?.toISOString() ?? null
-    }
+    },
+    ingestionRate: stats.ingestionRate
   };
 }
 function createApiApp(db, ingester) {
@@ -159,6 +227,10 @@ function createApiApp(db, ingester) {
     try {
       const { source } = c.req.valid("query");
       const stats = await db.getStats(source ? { source } : void 0);
+      if (ingester) {
+        const ingestionStats = ingester.getIngestionStats();
+        stats.ingestionRate = ingestionStats.ingestionRate;
+      }
       return c.json(serializeStats$1(stats));
     } catch (err) {
       return c.json(
@@ -174,24 +246,18 @@ function createApiApp(db, ingester) {
   }).get("/logs", zValidator("query", logQuerySchema, validationHook), async (c) => {
     try {
       const params = c.req.valid("query");
-      let jsonFilters;
-      if (params.jsonFilters) {
-        try {
-          jsonFilters = JSON.parse(params.jsonFilters);
-        } catch {
-        }
-      }
       const queryParams = {
-        level: params.level,
-        service: params.service,
-        source: params.source,
+        level: splitLevels(params.level),
+        service: splitStrings(params.service),
+        host: splitStrings(params.host),
+        source: splitStrings(params.source),
         search: params.search,
         startTime: params.startTime,
         endTime: params.endTime,
         limit: params.limit,
         offset: params.offset,
         order: params.order,
-        jsonFilters
+        jsonFilters: parseJsonFilters(params.jsonFilters)
       };
       const result = await db.queryLogs(queryParams);
       return c.json({
@@ -209,6 +275,32 @@ function createApiApp(db, ingester) {
         500
       );
     }
+  }).get("/histogram", zValidator("query", histogramQuerySchema, validationHook), async (c) => {
+    try {
+      const params = c.req.valid("query");
+      const result = await db.getHistogram({
+        buckets: params.buckets,
+        startTime: params.startTime,
+        endTime: params.endTime,
+        level: splitLevels(params.level),
+        service: splitStrings(params.service),
+        host: splitStrings(params.host),
+        source: splitStrings(params.source),
+        search: params.search,
+        jsonFilters: parseJsonFilters(params.jsonFilters)
+      });
+      return c.json(result);
+    } catch (err) {
+      return c.json(
+        {
+          error: {
+            code: "QUERY_ERROR",
+            message: err instanceof Error ? err.message : "Unknown error"
+          }
+        },
+        500
+      );
+    }
   }).post("/query", zValidator("json", sqlQuerySchema, validationHook), async (c) => {
     try {
       const { sql } = c.req.valid("json");
@@ -241,9 +333,9 @@ function createApiApp(db, ingester) {
     try {
       const params = c.req.valid("json");
       const queryParams = {
-        level: params.level,
-        service: params.service,
-        source: params.source,
+        level: splitLevels(params.level),
+        service: splitStrings(params.service),
+        source: splitStrings(params.source),
         search: params.search,
         startTime: params.startTime,
         endTime: params.endTime,
@@ -293,21 +385,15 @@ function createApiApp(db, ingester) {
   }).get("/facets", zValidator("query", facetQuerySchema, validationHook), async (c) => {
     try {
       const params = c.req.valid("query");
-      let jsonFilters;
-      if (params.jsonFilters) {
-        try {
-          jsonFilters = JSON.parse(params.jsonFilters);
-        } catch {
-        }
-      }
       const filters = {
-        level: params.level,
-        service: params.service,
-        source: params.source,
+        level: splitLevels(params.level),
+        service: splitStrings(params.service),
+        host: splitStrings(params.host),
+        source: splitStrings(params.source),
         search: params.search,
         startTime: params.startTime,
         endTime: params.endTime,
-        jsonFilters
+        jsonFilters: parseJsonFilters(params.jsonFilters)
       };
       const distribution = await db.getFacetDistribution(
         params.field,
@@ -333,6 +419,31 @@ new Hono().basePath("/api").get(
   "/health",
   (c) => c.json({ status: "ok", uptime: 0 })
 );
+const SEARCHABLE_FIELDS = /* @__PURE__ */ new Set([
+  "message",
+  "service",
+  "host",
+  "trace_id",
+  "level"
+]);
+function parseSearchQuery(search) {
+  const colonIndex = search.indexOf(":");
+  if (colonIndex <= 0) {
+    return { field: null, value: search };
+  }
+  const field = search.substring(0, colonIndex);
+  const value = search.substring(colonIndex + 1);
+  if (field.includes(" ")) {
+    return { field: null, value: search };
+  }
+  if (value === "") {
+    return { field: null, value: search };
+  }
+  if (!SEARCHABLE_FIELDS.has(field)) {
+    return { field: null, value: search };
+  }
+  return { field, value };
+}
 const CREATE_TABLE_SQL = `
 CREATE TABLE IF NOT EXISTS logs (
     _id         BIGINT PRIMARY KEY,
@@ -457,12 +568,13 @@ class LogDatabase {
         total: 0,
         byLevel: {},
         errorRate: 0,
-        timeRange: { min: null, max: null }
+        timeRange: { min: null, max: null },
+        ingestionRate: 0
       };
     }
     const levelWhereClause = whereClause ? `${whereClause} AND level IS NOT NULL` : "WHERE level IS NOT NULL";
     const levelReader = await conn.runAndReadAll(
-      `SELECT level, COUNT(*) as cnt FROM logs ${levelWhereClause} GROUP BY level ORDER BY cnt DESC`
+      `SELECT UPPER(level) as lvl, COUNT(*) as cnt FROM logs ${levelWhereClause} GROUP BY lvl ORDER BY cnt DESC`
     );
     const byLevel = {};
     for (const row of levelReader.getRowsJS()) {
@@ -481,7 +593,8 @@ class LogDatabase {
       timeRange: {
         min: timeRow[0] !== null ? jsToDate(timeRow[0]) : null,
         max: timeRow[1] !== null ? jsToDate(timeRow[1]) : null
-      }
+      },
+      ingestionRate: 0
     };
   }
   // -------------------------------------------------------------------------
@@ -490,11 +603,13 @@ class LogDatabase {
   async getFacetDistribution(field, jsonPath, filters) {
     const conn = this.getConnection();
     const columnExpr = jsonPath !== null ? `CAST(json_extract(_raw, '${escapeSql("$." + jsonPath)}') AS VARCHAR)` : `"${field}"`;
+    const isLevelField = field === "level" && jsonPath === null;
+    const selectExpr = isLevelField ? `UPPER(${columnExpr})` : columnExpr;
     const conditions = buildFilterConditions(filters);
     conditions.push(`${columnExpr} IS NOT NULL`);
     const whereClause = `WHERE ${conditions.join(" AND ")}`;
     const reader = await conn.runAndReadAll(
-      `SELECT ${columnExpr} as val, COUNT(*) as cnt FROM logs ${whereClause} GROUP BY val ORDER BY cnt DESC, val ASC`
+      `SELECT ${selectExpr} as val, COUNT(*) as cnt FROM logs ${whereClause} GROUP BY val ORDER BY cnt DESC, val ASC`
     );
     const values = reader.getRowsJS().map((row) => {
       let value = String(row[0]);
@@ -506,6 +621,59 @@ class LogDatabase {
     return { field, values };
   }
   // -------------------------------------------------------------------------
+  // Histogram
+  // -------------------------------------------------------------------------
+  async getHistogram(params) {
+    const conn = this.getConnection();
+    const buckets = Math.min(360, Math.max(1, Math.floor(params.buckets ?? 30)));
+    const endTime = params.endTime ?? /* @__PURE__ */ new Date();
+    const startTime = params.startTime ?? new Date(endTime.getTime() - 60 * 60 * 1e3);
+    const rangeStartMs = Math.min(startTime.getTime(), endTime.getTime());
+    const rangeEndMs = Math.max(startTime.getTime(), endTime.getTime());
+    const spanMs = Math.max(1e3, rangeEndMs - rangeStartMs);
+    const intervalMs = Math.max(1e3, Math.floor(spanMs / buckets));
+    const interval = intervalMsToIntervalString(intervalMs);
+    const conditions = buildFilterConditions({
+      ...params,
+      startTime: new Date(rangeStartMs),
+      endTime: new Date(rangeEndMs)
+    });
+    conditions.push("timestamp IS NOT NULL");
+    conditions.push("level IS NOT NULL");
+    const whereClause = `WHERE ${conditions.join(" AND ")}`;
+    const reader = await conn.runAndReadAll(
+      `SELECT
+         time_bucket(INTERVAL '${interval}', timestamp) AS bucket,
+         UPPER(level) AS lvl,
+         COUNT(*) AS cnt
+       FROM logs
+       ${whereClause}
+       GROUP BY bucket, lvl
+       ORDER BY bucket ASC`
+    );
+    const countsByBucket = /* @__PURE__ */ new Map();
+    for (const row of reader.getRowsJS()) {
+      const bucketIso = jsToDate(row[0]).toISOString();
+      const level = String(row[1]);
+      const count = Number(row[2]);
+      const current = countsByBucket.get(bucketIso) ?? {};
+      current[level] = count;
+      countsByBucket.set(bucketIso, current);
+    }
+    const alignedStart = Math.floor(rangeStartMs / intervalMs) * intervalMs;
+    const histogramBuckets = Array.from({ length: buckets }, (_, i) => {
+      const timestamp = new Date(alignedStart + i * intervalMs).toISOString();
+      return {
+        timestamp,
+        counts: countsByBucket.get(timestamp) ?? {}
+      };
+    });
+    return {
+      buckets: histogramBuckets,
+      interval
+    };
+  }
+  // -------------------------------------------------------------------------
   // Custom SQL Execution
   // -------------------------------------------------------------------------
   async executeQuery(sql) {
@@ -607,6 +775,26 @@ function csvEscape(value) {
   }
   return str;
 }
+function intervalMsToIntervalString(intervalMs) {
+  const dayMs = 24 * 60 * 60 * 1e3;
+  const hourMs = 60 * 60 * 1e3;
+  const minuteMs = 60 * 1e3;
+  const secondMs = 1e3;
+  if (intervalMs % dayMs === 0) {
+    const days = Math.max(1, Math.floor(intervalMs / dayMs));
+    return `${days} ${days === 1 ? "day" : "days"}`;
+  }
+  if (intervalMs % hourMs === 0) {
+    const hours = Math.max(1, Math.floor(intervalMs / hourMs));
+    return `${hours} ${hours === 1 ? "hour" : "hours"}`;
+  }
+  if (intervalMs % minuteMs === 0) {
+    const minutes = Math.max(1, Math.floor(intervalMs / minuteMs));
+    return `${minutes} ${minutes === 1 ? "minute" : "minutes"}`;
+  }
+  const seconds = Math.max(1, Math.floor(intervalMs / secondMs));
+  return `${seconds} ${seconds === 1 ? "second" : "seconds"}`;
+}
 function appendNullableVarchar(appender, value) {
   if (value !== null) {
     appender.appendVarchar(value);
@@ -628,19 +816,45 @@ function appendNullableDouble(appender, value) {
     appender.appendNull();
   }
 }
+function buildArrayCondition(column, values, caseInsensitive = false) {
+  if (caseInsensitive) {
+    const upperValues = values.map((v) => v.toUpperCase());
+    if (upperValues.length === 1) {
+      return `UPPER(${column}) = '${escapeSql(upperValues[0])}'`;
+    }
+    const escaped2 = upperValues.map((v) => `'${escapeSql(v)}'`).join(", ");
+    return `UPPER(${column}) IN (${escaped2})`;
+  }
+  if (values.length === 1) {
+    return `${column} = '${escapeSql(values[0])}'`;
+  }
+  const escaped = values.map((v) => `'${escapeSql(v)}'`).join(", ");
+  return `${column} IN (${escaped})`;
+}
 function buildFilterConditions(params) {
   const conditions = [];
-  if (params.level) {
-    conditions.push(`level = '${escapeSql(params.level)}'`);
+  if (params.level && params.level.length > 0) {
+    conditions.push(buildArrayCondition("level", params.level, true));
   }
-  if (params.service) {
-    conditions.push(`service = '${escapeSql(params.service)}'`);
+  if (params.service && params.service.length > 0) {
+    conditions.push(buildArrayCondition("service", params.service));
   }
-  if (params.source) {
-    conditions.push(`source = '${escapeSql(params.source)}'`);
+  if (params.host && params.host.length > 0) {
+    conditions.push(buildArrayCondition("host", params.host));
+  }
+  if (params.source && params.source.length > 0) {
+    conditions.push(buildArrayCondition("source", params.source));
   }
   if (params.search) {
-    conditions.push(`message ILIKE '%${escapeSql(params.search)}%'`);
+    const parsed = parseSearchQuery(params.search);
+    if (parsed.field !== null) {
+      conditions.push(`${parsed.field} ILIKE '%${escapeSql(parsed.value)}%'`);
+    } else {
+      const kw = escapeSql(parsed.value);
+      conditions.push(
+        `(message ILIKE '%${kw}%' OR service ILIKE '%${kw}%' OR host ILIKE '%${kw}%' OR trace_id ILIKE '%${kw}%' OR CAST(_raw AS VARCHAR) ILIKE '%${kw}%')`
+      );
+    }
   }
   if (params.startTime) {
     conditions.push(`timestamp >= '${params.startTime.toISOString()}'`);
@@ -649,9 +863,11 @@ function buildFilterConditions(params) {
     conditions.push(`timestamp <= '${params.endTime.toISOString()}'`);
   }
   if (params.jsonFilters) {
-    for (const [jsonPath, value] of Object.entries(params.jsonFilters)) {
+    for (const [jsonPath, values] of Object.entries(params.jsonFilters)) {
       const expr = `CAST(json_extract(_raw, '${escapeSql("$." + jsonPath)}') AS VARCHAR)`;
-      conditions.push(`${expr} = '${escapeSql(value)}'`);
+      if (values.length > 0) {
+        conditions.push(buildArrayCondition(expr, values));
+      }
     }
   }
   return conditions;
@@ -661,10 +877,21 @@ function buildWhereClause(params) {
   return conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
 }
 function rowToLogEntry(row) {
+  let rawParsed;
+  if (typeof row[2] === "string") {
+    try {
+      const parsed = JSON.parse(row[2]);
+      rawParsed = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : { _value: parsed };
+    } catch {
+      rawParsed = { message: row[2] };
+    }
+  } else {
+    rawParsed = row[2] ?? {};
+  }
   return {
     _id: BigInt(row[0]),
     _ingested: jsToDate(row[1]),
-    _raw: typeof row[2] === "string" ? JSON.parse(row[2]) : row[2],
+    _raw: rawParsed,
     timestamp: row[3] !== null ? jsToDate(row[3]) : null,
     level: row[4],
     message: row[5],
@@ -675,25 +902,6 @@ function rowToLogEntry(row) {
     source: row[10]
   };
 }
-const FIELD_MAPPINGS = {
-  timestamp: ["timestamp", "ts", "time", "@timestamp", "datetime"],
-  level: ["level", "severity", "loglevel", "lvl", "priority"],
-  message: ["message", "msg", "body", "text"],
-  service: ["service", "svc", "app", "component", "logger"],
-  trace_id: ["trace_id", "traceId", "request_id", "correlation_id"]
-};
-const REVERSE_FIELD_MAP = (() => {
-  const map = /* @__PURE__ */ new Map();
-  for (const [canonical, aliases] of Object.entries(FIELD_MAPPINGS)) {
-    for (const alias of aliases) {
-      map.set(alias, canonical);
-    }
-  }
-  return map;
-})();
-function resolveField(fieldName) {
-  return REVERSE_FIELD_MAP.get(fieldName) ?? null;
-}
 class Ingester {
   db;
   options;
@@ -704,6 +912,11 @@ class Ingester {
   rl = null;
   stopped = false;
   flushing = null;
+  // Sliding window for ingestion rate calculation
+  static RATE_WINDOW_MS = 1e4;
+  // 10 seconds
+  batchRecords = [];
+  lastBatchTime = null;
   constructor(db, options) {
     this.db = db;
     this.options = options;
@@ -763,6 +976,23 @@ class Ingester {
   on(event, listener) {
     this.emitter.on(event, listener);
   }
+  /**
+   * Returns the current ingestion statistics including the smoothed
+   * ingestion rate (logs/second) over a 10-second sliding window.
+   */
+  getIngestionStats() {
+    const now = Date.now();
+    const windowStart = now - Ingester.RATE_WINDOW_MS;
+    this.batchRecords = this.batchRecords.filter(
+      (r) => r.timestamp >= windowStart
+    );
+    const totalLogs = this.batchRecords.reduce((sum, r) => sum + r.size, 0);
+    const ingestionRate = totalLogs / (Ingester.RATE_WINDOW_MS / 1e3);
+    return {
+      ingestionRate,
+      lastBatchTime: this.lastBatchTime
+    };
+  }
   // -------------------------------------------------------------------------
   // Line processing
   // -------------------------------------------------------------------------
@@ -770,15 +1000,18 @@ class Ingester {
     const trimmed = line.trim();
     if (trimmed === "") return;
     let parsed;
+    let raw;
     try {
       parsed = JSON.parse(trimmed);
+      raw = trimmed;
     } catch {
-      return;
+      parsed = { message: trimmed, level: "INFO", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+      raw = JSON.stringify(parsed);
     }
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       return;
     }
-    const normalized = this.normalize(parsed, trimmed);
+    const normalized = this.normalize(parsed, raw);
     this.buffer.push(normalized);
     if (this.buffer.length >= this.options.batchSize) {
       this.flushBuffer();
@@ -843,6 +1076,9 @@ class Ingester {
     try {
       await this.db.insertBatch(batch);
       await this.db.evictOldRows(this.options.maxRows);
+      const now = Date.now();
+      this.batchRecords.push({ timestamp: now, size: batch.length });
+      this.lastBatchTime = new Date(now);
       this.emitter.emit("batch", batch);
     } catch (err) {
       console.error("[ingester] doFlush error:", err);
@@ -864,13 +1100,16 @@ class Ingester {
   }
 }
 function matchesFilter(log, filter) {
-  if (filter.level !== void 0 && log.level !== filter.level) {
+  if (filter.level && filter.level.length > 0 && !filter.level.map((l) => l.toUpperCase()).includes(log.level?.toUpperCase())) {
+    return false;
+  }
+  if (filter.service && filter.service.length > 0 && !filter.service.includes(log.service ?? "")) {
     return false;
   }
-  if (filter.service !== void 0 && log.service !== filter.service) {
+  if (filter.host && filter.host.length > 0 && !filter.host.includes(log.host ?? "")) {
     return false;
   }
-  if (filter.source !== void 0 && log.source !== filter.source) {
+  if (filter.source && filter.source.length > 0 && !filter.source.includes(log.source)) {
     return false;
   }
   if (filter.search !== void 0 && filter.search !== "") {
@@ -910,7 +1149,8 @@ function serializeStats(stats) {
     timeRange: {
       min: stats.timeRange.min?.toISOString() ?? null,
       max: stats.timeRange.max?.toISOString() ?? null
-    }
+    },
+    ingestionRate: stats.ingestionRate
   };
 }
 class WSHandler {
@@ -940,6 +1180,8 @@ class WSHandler {
         }
       }
       if (stats) {
+        const ingestionStats = ingester.getIngestionStats();
+        stats.ingestionRate = ingestionStats.ingestionRate;
         this.broadcast([...logs], stats);
       }
     });
@@ -976,14 +1218,25 @@ class WSHandler {
     }
     const filterObj = msg.filter;
     const filter = {};
-    if (typeof filterObj.level === "string") {
-      filter.level = filterObj.level;
+    if (Array.isArray(filterObj.level)) {
+      filter.level = filterObj.level.filter((v) => typeof v === "string");
+    } else if (typeof filterObj.level === "string") {
+      filter.level = [filterObj.level];
     }
-    if (typeof filterObj.service === "string") {
-      filter.service = filterObj.service;
+    if (Array.isArray(filterObj.service)) {
+      filter.service = filterObj.service.filter((v) => typeof v === "string");
+    } else if (typeof filterObj.service === "string") {
+      filter.service = [filterObj.service];
     }
-    if (typeof filterObj.source === "string") {
-      filter.source = filterObj.source;
+    if (Array.isArray(filterObj.host)) {
+      filter.host = filterObj.host.filter((v) => typeof v === "string");
+    } else if (typeof filterObj.host === "string") {
+      filter.host = [filterObj.host];
+    }
+    if (Array.isArray(filterObj.source)) {
+      filter.source = filterObj.source.filter((v) => typeof v === "string");
+    } else if (typeof filterObj.source === "string") {
+      filter.source = [filterObj.source];
     }
     if (typeof filterObj.search === "string") {
       filter.search = filterObj.search;
@@ -1037,6 +1290,7 @@ function parseRelayArgs(args) {
       service: { type: "string", short: "s" },
       "batch-size": { type: "string" },
       interval: { type: "string" },
+      "max-retries": { type: "string" },
       help: { type: "boolean", short: "h" }
     },
     strict: true
@@ -1046,6 +1300,7 @@ function parseRelayArgs(args) {
     service: values.service,
     batchSize: values["batch-size"] !== void 0 ? parseInt(values["batch-size"], 10) : 100,
     intervalMs: values.interval !== void 0 ? parseInt(values.interval, 10) : 500,
+    maxRetries: values["max-retries"] !== void 0 ? parseInt(values["max-retries"], 10) : 3,
     help: values.help ?? false
   };
 }
@@ -1059,6 +1314,7 @@ Options:
   -s, --service <name>    Service name to inject into each log entry
       --batch-size <n>    Lines per HTTP batch (default: 100)
       --interval <ms>     Flush interval in milliseconds (default: 500)
+      --max-retries <n>   Max retry attempts on transient failure (default: 3)
   -h, --help              Show this help message
 
 Examples:
@@ -1066,6 +1322,75 @@ Examples:
   cat app.log | lduck relay --url http://lduck:9090 --service backend
   docker logs -f myapp | lduck relay -s myapp -u http://localhost:8080
 `.trimStart();
+function parseLine(line, service) {
+  const trimmed = line.trim();
+  if (trimmed === "") return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    parsed = { message: trimmed, level: "INFO", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return null;
+  }
+  if (service !== void 0 && !("service" in parsed)) {
+    parsed.service = service;
+  }
+  return parsed;
+}
+function computeBackoffDelay(attempt, baseDelay, maxDelay) {
+  return Math.min(baseDelay * 2 ** attempt, maxDelay);
+}
+function accumulateFlushResult(summary, result) {
+  return {
+    totalSent: summary.totalSent + result.accepted,
+    totalErrors: summary.totalErrors + result.errors,
+    totalRetries: summary.totalRetries + result.retries
+  };
+}
+function formatRelaySummary(summary) {
+  return `[relay] Done. Sent: ${summary.totalSent}, Errors: ${summary.totalErrors}, Retries: ${summary.totalRetries}`;
+}
+const DEFAULT_BASE_DELAY = 100;
+const DEFAULT_MAX_DELAY = 3e4;
+function isRetryableStatus(status) {
+  return status >= 500;
+}
+async function flushWithRetry(batch, ingestUrl, maxRetries, fetchFn = globalThis.fetch, backoffOptions) {
+  const baseDelay = DEFAULT_BASE_DELAY;
+  const maxDelay = DEFAULT_MAX_DELAY;
+  let retries = 0;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    if (attempt > 0) {
+      const delay = computeBackoffDelay(attempt - 1, baseDelay, maxDelay);
+      await new Promise((resolve) => setTimeout(resolve, delay));
+      retries++;
+    }
+    try {
+      const res = await fetchFn(ingestUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(batch)
+      });
+      if (res.ok) {
+        const result = await res.json();
+        return { accepted: result.accepted, errors: 0, retries };
+      }
+      if (!isRetryableStatus(res.status)) {
+        const text2 = await res.text();
+        console.error(`[relay] HTTP ${res.status}: ${text2}`);
+        return { accepted: 0, errors: batch.length, retries: 0 };
+      }
+      const text = await res.text();
+      console.error(`[relay] HTTP ${res.status}: ${text} (attempt ${attempt + 1}/${maxRetries + 1})`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[relay] Send failed: ${message} (attempt ${attempt + 1}/${maxRetries + 1})`);
+    }
+  }
+  return { accepted: 0, errors: batch.length, retries };
+}
 async function runRelay(args) {
   const opts = parseRelayArgs(args);
   if (opts.help) {
@@ -1075,32 +1400,14 @@ async function runRelay(args) {
   const ingestUrl = opts.url.replace(/\/$/, "") + "/api/ingest";
   let buffer = [];
   let flushTimer = null;
-  let totalSent = 0;
-  let totalErrors = 0;
+  let summary = { totalSent: 0, totalErrors: 0, totalRetries: 0 };
   let stdinClosed = false;
   async function flush() {
     if (buffer.length === 0) return;
     const batch = buffer;
     buffer = [];
-    try {
-      const res = await fetch(ingestUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(batch)
-      });
-      if (!res.ok) {
-        const text = await res.text();
-        console.error(`[relay] HTTP ${res.status}: ${text}`);
-        totalErrors += batch.length;
-      } else {
-        const result = await res.json();
-        totalSent += result.accepted;
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      console.error(`[relay] Send failed: ${message}`);
-      totalErrors += batch.length;
-    }
+    const result = await flushWithRetry(batch, ingestUrl, opts.maxRetries);
+    summary = accumulateFlushResult(summary, result);
   }
   function resetFlushTimer() {
     if (flushTimer !== null) {
@@ -1121,20 +1428,8 @@ async function runRelay(args) {
   console.error(`[relay] Relaying to ${ingestUrl}${opts.service ? ` (service: ${opts.service})` : ""}`);
   resetFlushTimer();
   rl.on("line", (line) => {
-    const trimmed = line.trim();
-    if (trimmed === "") return;
-    let parsed;
-    try {
-      parsed = JSON.parse(trimmed);
-    } catch {
-      return;
-    }
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-      return;
-    }
-    if (opts.service !== void 0 && !("service" in parsed)) {
-      parsed.service = opts.service;
-    }
+    const parsed = parseLine(line, opts.service);
+    if (parsed === null) return;
     buffer.push(parsed);
     if (buffer.length >= opts.batchSize) {
       flush();
@@ -1148,11 +1443,7 @@ async function runRelay(args) {
         flushTimer = null;
       }
       await flush();
-      if (totalSent > 0 || totalErrors > 0) {
-        console.error(
-          `[relay] Done. Sent: ${totalSent}, Errors: ${totalErrors}`
-        );
-      }
+      console.error(formatRelaySummary(summary));
       resolve();
     });
   });