dlogify 0.1.0__py3-none-any.whl

dlogify/_http.py

@@ -0,0 +1,52 @@
+"""The exporter's transport: one POST with urllib.request."""
+
+from __future__ import annotations
+
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass(frozen=True)
+class Response:
+    status: int
+    headers: dict[str, str]
+    body: str
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    # A redirect would turn the POST into a GET or drop the body; the exporter
+    # reports it instead (urllib then raises HTTPError with the 3xx status).
+    def redirect_request(self, req: Any, fp: Any, code: int, msg: str, headers: Any, newurl: str) -> None:
+        return None
+
+
+_opener = urllib.request.build_opener(_NoRedirect)
+_MAX_BODY = 64 * 1024
+
+
+def post(url: str, body: bytes, headers: dict[str, str], timeout: float) -> Response:
+    """Raises on network errors and timeouts; any HTTP status is a Response."""
+    request = urllib.request.Request(url, data=body, headers=headers, method="POST")
+    try:
+        with _opener.open(request, timeout=timeout) as response:
+            return Response(response.status, _headers(response.headers), _read(response))
+    except urllib.error.HTTPError as err:
+        try:
+            return Response(err.code, _headers(err.headers), _read(err))
+        finally:
+            err.close()
+
+
+def _headers(message: Any) -> dict[str, str]:
+    if message is None:
+        return {}
+    return {key.lower(): value for key, value in message.items()}
+
+
+def _read(response: Any) -> str:
+    try:
+        return response.read(_MAX_BODY).decode("utf-8", "replace")
+    except Exception:
+        return ""

dlogify/_levels.py

@@ -0,0 +1,88 @@
+"""Client levels and how sources map onto them (docs/12 §3, §5.2, §5.3)."""
+
+from __future__ import annotations
+
+import math
+from typing import Literal, Optional
+
+Level = Literal["trace", "debug", "info", "warn", "error", "fatal"]
+LEVELS: tuple[Level, ...] = ("trace", "debug", "info", "warn", "error", "fatal")
+
+_SEVERITY: dict[str, tuple[int, str]] = {
+    "trace": (1, "TRACE"),
+    "debug": (5, "DEBUG"),
+    "info": (9, "INFO"),
+    "warn": (13, "WARN"),
+    "error": (17, "ERROR"),
+    "fatal": (21, "FATAL"),
+}
+
+# The logging level a LogifyHandler gets for each min_level.
+LEVELNO: dict[Level, int] = {"trace": 1, "debug": 10, "info": 20, "warn": 30, "error": 40, "fatal": 50}
+
+
+def severity(level: Level) -> tuple[int, str]:
+    return _SEVERITY[level]
+
+
+def is_level(value: object) -> bool:
+    return isinstance(value, str) and value in _SEVERITY
+
+
+def level_rank(level: Optional[Level]) -> int:
+    """Unknown levels (only `logify run` produces them) rank as info."""
+    return LEVELS.index(level or "info")
+
+
+# Longer words first so a regex alternation prefers WARNING over WARN.
+LEVEL_WORD_PATTERN = "WARNING|WARN|ERROR|ERR|TRACE|DEBUG|INFO|NOTICE|FATAL|CRITICAL|PANIC"
+
+_WORDS: dict[str, Level] = {
+    "TRACE": "trace",
+    "DEBUG": "debug",
+    "INFO": "info",
+    "NOTICE": "info",
+    "WARN": "warn",
+    "WARNING": "warn",
+    "ERROR": "error",
+    "ERR": "error",
+    "FATAL": "fatal",
+    "CRITICAL": "fatal",
+    "PANIC": "fatal",
+}
+
+
+def level_from_word(word: str) -> Optional[Level]:
+    return _WORDS.get(word.strip().upper())
+
+
+def level_from_number(number: float) -> Optional[Level]:
+    """pino/bunyan scale; custom numbers map to the nearest lower standard level."""
+    if not math.isfinite(number) or number < 10:
+        return None
+    if number >= 60:
+        return "fatal"
+    if number >= 50:
+        return "error"
+    if number >= 40:
+        return "warn"
+    if number >= 30:
+        return "info"
+    if number >= 20:
+        return "debug"
+    return "trace"
+
+
+def level_from_levelno(levelno: int) -> Level:
+    """Python logging levels; custom levels map to the nearest lower standard level."""
+    if levelno >= 50:
+        return "fatal"
+    if levelno >= 40:
+        return "error"
+    if levelno >= 30:
+        return "warn"
+    if levelno >= 20:
+        return "info"
+    if levelno >= 10:
+        return "debug"
+    return "trace"

dlogify/_parse/compact_json.py

@@ -0,0 +1,55 @@
+"""Compact JSON as JavaScript's JSON.stringify writes it, so nested values in
+JSON lines render the same in both SDKs (docs/12 §5.2)."""
+
+from __future__ import annotations
+
+import json
+import math
+from typing import Any, Union
+
+MAX_SAFE_INT = 2**53
+
+
+def js_number(value: Union[int, float]) -> str:
+    if isinstance(value, int) and abs(value) <= MAX_SAFE_INT:
+        return str(value)
+    try:
+        number = float(value)
+    except OverflowError:
+        return "null"
+    if not math.isfinite(number):
+        return "null"
+    if number == 0:
+        return "0"
+    # repr() gives the shortest round-trip digits, like JavaScript; only the
+    # placement of the exponent differs.
+    mantissa, _, exponent = repr(number).partition("e")
+    sign = "-" if mantissa.startswith("-") else ""
+    mantissa = mantissa.lstrip("-")
+    if not exponent:
+        return sign + (mantissa[:-2] if mantissa.endswith(".0") else mantissa)
+    power = int(exponent)
+    if power >= 21 or power <= -7:
+        return f"{sign}{mantissa}e{'+' if power > 0 else '-'}{abs(power)}"
+    digits = mantissa.replace(".", "")
+    if power < 0:
+        return f"{sign}0.{'0' * (-power - 1)}{digits}"
+    return f"{sign}{digits}{'0' * (power + 1 - len(digits))}"
+
+
+def compact_json(value: Any) -> str:
+    if value is None:
+        return "null"
+    if value is True:
+        return "true"
+    if value is False:
+        return "false"
+    if isinstance(value, str):
+        return json.dumps(value, ensure_ascii=False)
+    if isinstance(value, (int, float)):
+        return js_number(value)
+    if isinstance(value, list):
+        return "[" + ",".join(compact_json(item) for item in value) + "]"
+    if isinstance(value, dict):
+        return "{" + ",".join(f"{json.dumps(key, ensure_ascii=False)}:{compact_json(item)}" for key, item in value.items()) + "}"
+    return json.dumps(str(value), ensure_ascii=False)

dlogify/_parse/json_line.py

@@ -0,0 +1,178 @@
+"""docs/12 §5.2: a line that is a JSON object is one complete record."""
+
+from __future__ import annotations
+
+import json
+import math
+import re
+from datetime import datetime, timedelta, timezone
+from typing import Any, Callable, Optional
+
+from .._levels import Level, level_from_number, level_from_word
+from .._record import AttributeValue, ms_to_unix_nano
+from .compact_json import MAX_SAFE_INT, compact_json
+from .text_event import ParsedRecord, extract_exception
+
+_BODY_KEYS = ("msg", "message", "@message", "event")
+_LEVEL_KEYS = ("level", "severity", "levelname", "@level", "log.level")
+_TIME_KEYS = ("time", "timestamp", "@timestamp", "ts")
+_ERROR_KEYS = ("err", "error", "exception")
+_ISO_TIME = re.compile(
+    r"^([0-9]{4})-([0-9]{2})-([0-9]{2})[T ]([0-9]{2}):([0-9]{2})(?::([0-9]{2}))?(?:[.,]([0-9]+))?(Z|[+-][0-9]{2}(?::?[0-9]{2})?)?$",
+    re.IGNORECASE,
+)
+_EPOCH = datetime(1970, 1, 1, tzinfo=timezone.utc)
+
+
+def _reject_constant(name: str) -> None:
+    raise ValueError(f"{name} is not JSON")  # NaN and Infinity, which JavaScript rejects too
+
+
+def parse_json_line(line: str) -> Optional[ParsedRecord]:
+    if line.lstrip()[:1] != "{":
+        return None
+    try:
+        fields = json.loads(line, parse_constant=_reject_constant)
+    except (ValueError, RecursionError):
+        return None
+    if not isinstance(fields, dict):
+        return None
+    try:
+        return _record(fields)
+    except RecursionError:
+        return None
+
+
+def _record(fields: dict[str, Any]) -> ParsedRecord:
+    def first(keys: tuple[str, ...], accept: Callable[[Any], bool] = lambda value: True) -> Optional[tuple[str, Any]]:
+        for key in keys:
+            value = fields.get(key)
+            if value is not None and accept(value):
+                return key, value
+        return None
+
+    body_entry = first(_BODY_KEYS, lambda value: isinstance(value, str))
+    level_entry = first(_LEVEL_KEYS)
+    time_entry = first(_TIME_KEYS)
+    error_entry = first(_ERROR_KEYS)
+    exception = _error_attributes(error_entry[1]) if error_entry else None
+    used = {entry[0] for entry in (body_entry, level_entry, time_entry) if entry}
+    if error_entry and exception:
+        used.add(error_entry[0])
+    attributes: dict[str, AttributeValue] = dict(exception or {})
+    for key, value in fields.items():
+        if key in used or value is None:
+            continue
+        attributes[key] = _attribute(value)
+    return ParsedRecord(
+        level=_json_level(level_entry[1]) if level_entry else None,
+        body=body_entry[1] if body_entry else "",
+        attributes=attributes,
+        time_unix_nano=_json_time(time_entry[1]) if time_entry else None,
+    )
+
+
+def _to_float(value: Any) -> float:
+    try:
+        return float(value)
+    except OverflowError:
+        return math.inf if value > 0 else -math.inf
+
+
+def _attribute(value: Any) -> AttributeValue:
+    if isinstance(value, (str, bool)):
+        return value
+    if isinstance(value, int):
+        return value if abs(value) <= MAX_SAFE_INT else _to_float(value)
+    if isinstance(value, float):
+        return int(value) if value.is_integer() and abs(value) <= MAX_SAFE_INT else value
+    return compact_json(value)
+
+
+def _json_level(value: Any) -> Optional[Level]:
+    if isinstance(value, bool):
+        return None
+    if isinstance(value, str):
+        return level_from_word(value)
+    if isinstance(value, (int, float)):
+        return level_from_number(_to_float(value))
+    return None
+
+
+def _json_time(value: Any) -> Optional[str]:
+    if isinstance(value, bool):
+        return None
+    if isinstance(value, (int, float)):
+        number = _to_float(value)
+        if not math.isfinite(number) or number < 0:
+            return None
+        ms = number if number > 1e11 else number * 1000
+        return ms_to_unix_nano(ms) if math.isfinite(ms) else None
+    if isinstance(value, str):
+        return parse_iso_time(value)
+    return None
+
+
+def parse_iso_time(text: str) -> Optional[str]:
+    """ISO 8601 date and time; without an offset it is local time, as in JavaScript's Date.parse."""
+    match = _ISO_TIME.match(text.strip())
+    if not match:
+        return None
+    year, month, day, hour, minute, second, fraction, zone = match.groups()
+    try:
+        tz = _zone(zone)
+        moment = datetime(int(year), int(month), int(day), int(hour), int(minute), int(second or 0), tzinfo=tz)
+        if tz is None:
+            moment = moment.astimezone()
+        delta = moment - _EPOCH
+    except (ValueError, OverflowError, OSError):
+        return None
+    seconds = delta.days * 86400 + delta.seconds
+    nanos = int(((fraction or "") + "000000000")[:9])
+    return str(seconds * 1_000_000_000 + nanos)
+
+
+def _zone(zone: Optional[str]) -> Optional[timezone]:
+    if not zone:
+        return None
+    if zone.upper() == "Z":
+        return timezone.utc
+    sign = -1 if zone[0] == "-" else 1
+    digits = zone[1:].replace(":", "")
+    hours = int(digits[:2])
+    minutes = int(digits[2:4] or 0)
+    return timezone(sign * timedelta(hours=hours, minutes=minutes))
+
+
+def _error_attributes(value: Any) -> Optional[dict[str, str]]:
+    if isinstance(value, str):
+        exception = extract_exception(re.split(r"\r?\n", value))
+        if exception is None:
+            return None
+        return {
+            "exception.type": exception.type,
+            "exception.message": exception.message,
+            "exception.stacktrace": exception.stacktrace,
+        }
+    if not isinstance(value, dict):
+        return None
+
+    def text(key: str) -> Optional[str]:
+        item = value.get(key)
+        return item if isinstance(item, str) else None
+
+    out: dict[str, str] = {}
+    type_ = text("type")
+    if type_ is None:
+        type_ = text("name")
+    message = text("message")
+    stack = text("stack")
+    if stack is None:
+        stack = text("stacktrace")
+    if type_ is not None:
+        out["exception.type"] = type_
+    if message is not None:
+        out["exception.message"] = message
+    if stack is not None:
+        out["exception.stacktrace"] = stack
+    return out or None

dlogify/_parse/lines.py

@@ -0,0 +1,64 @@
+"""docs/12 §5.1: lines end at \\n (a trailing \\r is removed), are cut to 64 KB
+and decoded as UTF-8 with replacement characters."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+from .._record import utf8_cut_index
+
+MAX_LINE_BYTES = 64 * 1024
+# Kept beyond the limit so the cut can see the next byte (UTF-8 boundary).
+_KEEP_BYTES = MAX_LINE_BYTES + 4
+_ANSI = re.compile(r"\x1b\[[0-9;?]*[ -/]*[@-~]")
+
+
+def strip_ansi(text: str) -> str:
+    return _ANSI.sub("", text)
+
+
+@dataclass(frozen=True)
+class Line:
+    text: str
+    truncated: bool
+
+
+class LineSplitter:
+    def __init__(self) -> None:
+        self._buffer = bytearray()
+        self._total = 0
+
+    def push(self, chunk: bytes) -> list[Line]:
+        lines = []
+        start = 0
+        while True:
+            newline = chunk.find(b"\n", start)
+            if newline == -1:
+                break
+            self._append(chunk[start:newline])
+            lines.append(self._take())
+            start = newline + 1
+        if start < len(chunk):
+            self._append(chunk[start:])
+        return lines
+
+    def end(self) -> list[Line]:
+        return [self._take()] if self._total > 0 else []
+
+    def _append(self, data: bytes) -> None:
+        self._total += len(data)
+        room = _KEEP_BYTES - len(self._buffer)
+        if room > 0 and data:
+            self._buffer += data[:room]
+
+    def _take(self) -> Line:
+        data = bytes(self._buffer)
+        truncated = self._total > MAX_LINE_BYTES
+        self._buffer = bytearray()
+        self._total = 0
+        if truncated:
+            data = data[: utf8_cut_index(data, MAX_LINE_BYTES)]
+        elif data.endswith(b"\r"):
+            data = data[:-1]
+        return Line(data.decode("utf-8", "replace"), truncated)

dlogify/_parse/stream_parser.py

@@ -0,0 +1,106 @@
+"""docs/12 §5: one parser per stream, each with its own open event. The clock
+(milliseconds) is injected so tests replay pauses without sleeping."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Callable, Optional
+
+from .._levels import Level
+from .._record import AttributeValue, ms_to_unix_nano
+from .json_line import parse_json_line
+from .lines import Line, LineSplitter, strip_ansi
+from .text_event import ParsedRecord, build_text_record, continues_event, is_blank
+
+IDLE_CLOSE_MS = 500
+MAX_EVENT_LINES = 500
+MAX_EVENT_BYTES = 40 * 1024
+
+
+@dataclass(frozen=True)
+class StreamRecord:
+    level: Optional[Level]
+    body: str
+    time_unix_nano: str
+    attributes: dict[str, AttributeValue]
+
+
+@dataclass
+class _OpenEvent:
+    started_at: float
+    lines: list[str] = field(default_factory=list)
+    bytes: int = 0
+    truncated: bool = False
+
+
+class StreamParser:
+    def __init__(self, stream: str, now: Callable[[], float], emit: Callable[[StreamRecord], None]) -> None:
+        self.stream = stream
+        self._now = now
+        self._emit_record = emit
+        self._splitter = LineSplitter()
+        self._event: Optional[_OpenEvent] = None
+        self._last_line_at = 0.0
+
+    def push(self, chunk: bytes) -> None:
+        for line in self._splitter.push(chunk):
+            self._line(line)
+
+    def tick(self) -> None:
+        """Called by a ticker: closes the open event after 500 ms without a line."""
+        if self._event is not None and self._now() - self._last_line_at >= IDLE_CLOSE_MS:
+            self._close()
+
+    def end(self) -> None:
+        for line in self._splitter.end():
+            self._line(line)
+        self._close()
+
+    def _line(self, line: Line) -> None:
+        now = self._now()
+        self._last_line_at = now
+        text = strip_ansi(line.text)
+        parsed = parse_json_line(text)
+        if parsed is not None:
+            self._close()
+            if line.truncated:
+                parsed.attributes["logify.truncated"] = True
+            self._emit(parsed, now)
+            return
+        if self._event is not None and continues_event(self._event.lines, text):
+            self._append(text, line.truncated)
+            return
+        self._close()
+        if is_blank(text):
+            return
+        self._event = _OpenEvent(started_at=now)
+        self._append(text, line.truncated)
+
+    def _append(self, text: str, truncated: bool) -> None:
+        event = self._event
+        assert event is not None
+        event.lines.append(text)
+        event.bytes += len(text.encode("utf-8", "replace")) + 1
+        event.truncated = event.truncated or truncated
+        if len(event.lines) >= MAX_EVENT_LINES or event.bytes >= MAX_EVENT_BYTES:
+            event.truncated = True
+            self._close()
+
+    def _close(self) -> None:
+        event = self._event
+        if event is None:
+            return
+        self._event = None
+        record = build_text_record(event.lines, event.truncated)
+        if record is not None:
+            self._emit(record, event.started_at)
+
+    def _emit(self, record: ParsedRecord, arrived_at: float) -> None:
+        self._emit_record(
+            StreamRecord(
+                level=record.level,
+                body=record.body,
+                time_unix_nano=record.time_unix_nano or ms_to_unix_nano(arrived_at),
+                attributes={"log.iostream": self.stream, **record.attributes},
+            )
+        )

dlogify/_parse/text_event.py

@@ -0,0 +1,150 @@
+"""docs/12 §5.3–5.6. Shared by `logify run` and (for strings in JSON) the
+JSON-line parser. A port of clients/typescript/src/parse/text-event.ts."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Sequence
+from dataclasses import dataclass, field
+from typing import Optional
+
+from .._levels import LEVEL_WORD_PATTERN, Level, level_from_word
+from .._record import AttributeValue, exception_title
+
+TRACEBACK = "Traceback (most recent call last):"
+_CHAIN_LINES = frozenset(
+    {
+        "During handling of the above exception, another exception occurred:",
+        "The above exception was the direct cause of the following exception:",
+    }
+)
+_PREFIX_LEVEL = re.compile(rf"^[\[(]?({LEVEL_WORD_PATTERN})(?=[\]):|\s]|$)", re.IGNORECASE | re.ASCII)
+_UPPER_LEVEL = re.compile(rf"(?<!\w)({LEVEL_WORD_PATTERN})(?!\w)", re.ASCII)
+_UPPER_WINDOW = 64
+_LEADING_TOKEN = re.compile(r"^\s*(\S+)")
+_TIMESTAMP_TOKEN = re.compile(r"^[0-9\-:.,/+TZ]+$")
+_DIGIT = re.compile(r"[0-9]")
+_PY_EXCEPTION_LINE = re.compile(r"^([A-Za-z_][\w.]*)(?:: (.*))?$", re.ASCII)
+_HEADER = re.compile(
+    r'^(?:Uncaught )?(?:Exception in thread "[^"]*" )?((?:[A-Za-z_$][\w$.]*)?(?:Error|Exception))(?: \[[\w-]+\])?: (.*)$', re.ASCII
+)
+_HEADER_TYPE_ONLY = re.compile(r"^((?:[A-Za-z_$][\w$.]*)?(?:Error|Exception))$", re.ASCII)
+_JAVA_MORE = re.compile(r"^\.\.\. [0-9]+ (more|common frames omitted)$")
+_NODE_VERSION = re.compile(r"^Node\.js v[0-9]+")
+_GO_PANIC = re.compile(r"^panic: (.*?)(?: \[recovered\])?$")
+_GO_FATAL = re.compile(r"^fatal error: (.*)$")
+_STACK_LINES = (re.compile(r"^\s+at "), re.compile(r'^\s+File "'), re.compile(r"\.go:[0-9]+"))
+
+
+@dataclass
+class ParsedRecord:
+    level: Optional[Level]
+    body: str
+    attributes: dict[str, AttributeValue] = field(default_factory=dict)
+    time_unix_nano: Optional[str] = None
+
+
+@dataclass(frozen=True)
+class ExtractedException:
+    type: str
+    message: str
+    stacktrace: str
+
+
+def is_blank(line: str) -> bool:
+    return line.strip() == ""
+
+
+def detect_level(line: str) -> Optional[Level]:
+    rest = line
+    for _ in range(2):
+        token = _LEADING_TOKEN.match(rest)
+        if not token or not _TIMESTAMP_TOKEN.match(token.group(1)) or not _DIGIT.search(token.group(1)):
+            break
+        rest = rest[token.end() :]
+    prefix = _PREFIX_LEVEL.match(rest.lstrip())
+    if prefix:
+        return level_from_word(prefix.group(1))
+    upper = _UPPER_LEVEL.search(line)
+    if upper and upper.end() <= _UPPER_WINDOW:
+        return level_from_word(upper.group(1))
+    return None
+
+
+def exception_header(line: str) -> Optional[tuple[str, str]]:
+    full = _HEADER.match(line)
+    if full:
+        return full.group(1), full.group(2)
+    type_only = _HEADER_TYPE_ONLY.match(line)
+    return (type_only.group(1), "") if type_only else None
+
+
+def extract_exception(lines: Sequence[str]) -> Optional[ExtractedException]:
+    if TRACEBACK in lines:
+        start = list(lines).index(TRACEBACK)
+        for i in range(len(lines) - 1, start, -1):
+            match = _PY_EXCEPTION_LINE.match(lines[i])
+            if match:
+                return ExtractedException(match.group(1), match.group(2) or "", "\n".join(lines[start:]))
+    first = lines[0] if lines else ""
+    panic = _GO_PANIC.match(first)
+    if panic:
+        return ExtractedException("panic", panic.group(1), "\n".join(lines))
+    fatal = _GO_FATAL.match(first)
+    if fatal:
+        return ExtractedException("fatal error", fatal.group(1), "\n".join(lines))
+    for i, line in enumerate(lines):
+        header = exception_header(line)
+        if header:
+            return ExtractedException(header[0], header[1], "\n".join(lines[i:]))
+    return None
+
+
+def continues_event(event: Sequence[str], line: str) -> bool:
+    first = event[0] if event else ""
+    last = event[-1] if event else ""
+    # 1. Indented, non-blank.
+    if not is_blank(line) and line[:1] in (" ", "\t"):
+        return True
+    # 2. Java causes and omitted frames, Python traceback starts.
+    if line.startswith("Caused by: ") or _JAVA_MORE.match(line) or line == TRACEBACK:
+        return True
+    # 3. Inside a Python traceback.
+    if TRACEBACK in event:
+        if line in _CHAIN_LINES:
+            return True
+        if _PY_EXCEPTION_LINE.match(line):
+            last_non_blank = next((item for item in reversed(event) if not is_blank(item)), "")
+            if last_non_blank[:1].isspace() or last_non_blank == TRACEBACK:
+                return True
+    # 4. Go panics take every following text line.
+    if first.startswith("panic: ") or first.startswith("fatal error: "):
+        return True
+    # 5. After a blank line: an exception header or Node's version line.
+    if is_blank(last) and (exception_header(line) is not None or _NODE_VERSION.match(line)):
+        return True
+    # 6. A blank line inside a multi-line event or after a header (kept tentatively).
+    if is_blank(line) and (len(event) > 1 or exception_header(first) is not None):
+        return True
+    return False
+
+
+def build_text_record(lines: Sequence[str], truncated: bool) -> Optional[ParsedRecord]:
+    kept = list(lines)
+    while kept and is_blank(kept[-1]):
+        kept.pop()
+    if not kept:
+        return None
+    detected = detect_level(kept[0])
+    exception = extract_exception(kept)
+    has_stack = exception is not None or any(pattern.search(line) for line in kept for pattern in _STACK_LINES)
+    level: Optional[Level] = detected or ("error" if has_stack else None)
+    body = (exception_title(exception.type, exception.message) if exception and not detected else kept[0]).rstrip()
+    attributes: dict[str, AttributeValue] = {}
+    if exception:
+        attributes["exception.type"] = exception.type
+        attributes["exception.message"] = exception.message
+        attributes["exception.stacktrace"] = exception.stacktrace
+    if truncated:
+        attributes["logify.truncated"] = True
+    return ParsedRecord(level, body, attributes)