pyr0ball
8d5324f1fe
Turnstone incidents now carry an issue_type tag (free-text with datalist
suggestions) used to categorize patterns for signature building.
Backend:
- Incident model gains issue_type; additive ALTER TABLE migration keeps
existing DBs working without a full schema rebuild
- New received_bundles table stores incoming JSON bundles with indexes on
bundled_at and issue_type
- build_bundle() assembles incident + related log entries into a versioned
bundle dict; store_bundle()/list_bundles()/get_bundle() for the receiver
- POST /api/incidents/{id}/send — pushes bundle to TURNSTONE_BUNDLE_ENDPOINT
- GET /api/incidents/{id}/bundle — export without sending
- POST /api/bundles — receive and store an incoming bundle
- GET /api/bundles — list all received bundles
- TURNSTONE_SOURCE_HOST and TURNSTONE_BUNDLE_ENDPOINT env vars; auto-set
source host from hostname in podman-standalone.sh
Frontend:
- Incidents form: issue_type field with datalist suggestions; Type column
in the table; Send Bundle button + status feedback in the detail drawer
- New BundlesView: collapsible bundle rows, inline JSON parse (no extra
round-trip), Export JSON download button
- Router and nav updated with /bundles route
62 lines
2.4 KiB
Python
62 lines
2.4 KiB
Python
"""Core data models for Turnstone log retrieval."""
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass, field
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class RetrievedEntry:
|
|
"""A log entry returned by the retriever, with source metadata and scores."""
|
|
|
|
entry_id: str
|
|
source_id: str # log file path or service name
|
|
sequence: int # original line number — ingest order, not wall-clock order
|
|
timestamp_raw: str | None # timestamp as it appeared in the log
|
|
timestamp_iso: str | None # parsed to ISO 8601 for sorting; None if unparseable
|
|
ingest_time: str # when Turnstone indexed this entry (wall clock)
|
|
severity: str | None # ERROR / WARN / INFO / DEBUG / None if not detected
|
|
repeat_count: int # collapsed duplicate count (1 = unique)
|
|
out_of_order: bool # True when timestamp precedes predecessor's timestamp
|
|
matched_patterns: tuple[str, ...] = field(default_factory=tuple) # named pattern hits
|
|
text: str = ""
|
|
bm25_score: float = 0.0
|
|
vector_score: float | None = None
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class LogPattern:
|
|
"""A named regex pattern for tagging entries at ingest time."""
|
|
|
|
name: str # e.g. "device_disconnect", "auth_failure"
|
|
pattern: str # regex string
|
|
severity: str # suggested severity if not present in log line
|
|
description: str # human-readable explanation for the UI
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class Incident:
|
|
"""A user-tagged time window marking a known event or failure."""
|
|
|
|
id: str # UUID
|
|
label: str # free-text description ("plex crash", "audio broken")
|
|
issue_type: str # short category tag for pattern building ("qbit_stall", "auth_failure")
|
|
started_at: str | None # ISO timestamp; None = open-ended start
|
|
ended_at: str | None # ISO timestamp; None = open-ended end
|
|
notes: str # additional context
|
|
created_at: str # wall-clock when this was tagged
|
|
severity: str # user-assigned: low / medium / high / critical
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class ReceivedBundle:
|
|
"""A labeled incident bundle received from a remote Turnstone instance."""
|
|
|
|
id: str
|
|
source_host: str
|
|
issue_type: str
|
|
label: str
|
|
severity: str
|
|
started_at: str | None
|
|
bundled_at: str
|
|
entry_count: int
|
|
bundle_json: str # full bundle serialized as JSON string
|