pyr0ball
dbdba4080f
- diagnose_stream() async generator: status/summary/entries/reasoning/done events - POST /api/diagnose/stream SSE endpoint wired in rest.py - entries_in_window() gains per_source_cap to prevent high-volume sources crowding results - QuickCapture: severity filter pills, filtered entries view, pipeline status spinner - llm.py: remove overly broad HTTPStatusError re-raise
253 lines
9.1 KiB
Python
253 lines
9.1 KiB
Python
"""Frictionless diagnose service — NL time extraction + layered log search."""
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
import dataclasses
|
|
import logging
|
|
import re
|
|
from collections.abc import AsyncGenerator
|
|
from datetime import datetime, timedelta, timezone
|
|
from pathlib import Path
|
|
from typing import Any
|
|
|
|
from app.services.llm import summarize
|
|
from app.services.search import SearchResult, entries_in_window, search
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
try:
|
|
from dateparser.search import search_dates as _search_dates # type: ignore[import]
|
|
_HAS_DATEPARSER = True
|
|
except ImportError:
|
|
_search_dates = None # type: ignore[assignment]
|
|
_HAS_DATEPARSER = False
|
|
|
|
|
|
_RELATIVE_RE = re.compile(
|
|
r"\b(?:last|past)\s+(\d+)?\s*(minute|hour|day|week)s?\b",
|
|
re.IGNORECASE,
|
|
)
|
|
_RELATIVE_UNITS = {"minute": 1, "hour": 60, "day": 1440, "week": 10080}
|
|
|
|
|
|
def _relative_window(match: re.Match) -> tuple[str, str]:
|
|
"""Convert a relative time match to (since_iso, until_iso)."""
|
|
n = int(match.group(1) or 1)
|
|
unit = match.group(2).lower()
|
|
minutes = n * _RELATIVE_UNITS[unit]
|
|
return _last_n_minutes(minutes), _now_iso()
|
|
|
|
|
|
def parse_time_window(query: str) -> tuple[str | None, str | None, str]:
|
|
"""Extract a time window from a natural-language query string.
|
|
|
|
Returns (since_iso, until_iso, keywords) where keywords is the query with
|
|
the matched time phrase stripped. Falls back to last-60-min window.
|
|
"""
|
|
# Handle relative expressions first ("last hour", "past 30 minutes", etc.)
|
|
# dateparser misinterprets these as absolute times.
|
|
m = _RELATIVE_RE.search(query)
|
|
if m:
|
|
since, until = _relative_window(m)
|
|
keywords = re.sub(r"\s{2,}", " ", query[:m.start()] + query[m.end():]).strip()
|
|
return since, until, keywords or query
|
|
|
|
if _HAS_DATEPARSER and _search_dates is not None:
|
|
# Tell dateparser what timezone the user is in so "3:35 am" means local time.
|
|
# PREFER_DAY_OF_MONTH is unused here but PREFER_DATES_FROM=past ensures
|
|
# "3:35 am" resolves to the most recent past occurrence, not a future one.
|
|
local_offset = datetime.now().astimezone().utcoffset()
|
|
offset_h = int((local_offset.total_seconds() if local_offset else 0) / 3600)
|
|
tz_str = f"UTC{'+' if offset_h >= 0 else ''}{offset_h}"
|
|
try:
|
|
results = _search_dates(
|
|
query,
|
|
languages=["en"],
|
|
settings={"PREFER_DATES_FROM": "past", "TIMEZONE": tz_str, "RETURN_AS_TIMEZONE_AWARE": True},
|
|
)
|
|
except Exception:
|
|
logger.warning("dateparser failed on query %r — falling back to 60-min window", query)
|
|
results = None
|
|
if results:
|
|
phrase, dt = results[0]
|
|
if dt.tzinfo is None:
|
|
dt = dt.replace(tzinfo=timezone.utc)
|
|
else:
|
|
dt = dt.astimezone(timezone.utc) # normalise to UTC for SQLite string compare
|
|
since = (dt - timedelta(minutes=30)).isoformat()
|
|
until = (dt + timedelta(minutes=30)).isoformat()
|
|
keywords = re.sub(r"\s{2,}", " ", query.replace(phrase, " ").strip())
|
|
return since, until, keywords or query
|
|
|
|
return _last_n_minutes(60), _now_iso(), query
|
|
|
|
|
|
def diagnose(
|
|
db_path: Path,
|
|
query: str,
|
|
since: str | None = None,
|
|
until: str | None = None,
|
|
source_filter: str | None = None,
|
|
llm_url: str | None = None,
|
|
llm_model: str | None = None,
|
|
llm_api_key: str | None = None,
|
|
) -> dict[str, Any]:
|
|
"""Run layered log search with NL time extraction. Returns summary + entries."""
|
|
time_detected = since is not None and until is not None
|
|
if not time_detected:
|
|
parsed_since, parsed_until, keywords = parse_time_window(query)
|
|
since = since or parsed_since
|
|
until = until or parsed_until
|
|
time_detected = keywords != query
|
|
else:
|
|
keywords = query
|
|
|
|
keyword_hits = search(db_path, query=keywords, since=since, until=until, source_filter=source_filter, limit=150, or_mode=True)
|
|
window_hits = entries_in_window(db_path, since=since, until=until, source_filter=source_filter, limit=50, per_source_cap=15)
|
|
|
|
seen: set[str] = set()
|
|
merged: list[SearchResult] = []
|
|
for r in keyword_hits + window_hits:
|
|
if r.entry_id not in seen:
|
|
seen.add(r.entry_id)
|
|
merged.append(r)
|
|
|
|
combined = sorted(merged, key=lambda r: (r.timestamp_iso or "\xff", r.sequence))[:200]
|
|
|
|
by_severity: dict[str, int] = {"CRITICAL": 0, "ERROR": 0, "WARN": 0, "INFO": 0}
|
|
by_source: dict[str, int] = {}
|
|
for r in combined:
|
|
sev = (r.severity or "INFO").upper()
|
|
if sev in by_severity:
|
|
by_severity[sev] += 1
|
|
by_source[r.source_id] = by_source.get(r.source_id, 0) + 1
|
|
|
|
reasoning: str | None = None
|
|
if llm_url and llm_model:
|
|
reasoning = summarize(query, combined, llm_url=llm_url, llm_model=llm_model, api_key=llm_api_key)
|
|
|
|
return {
|
|
"summary": {
|
|
"total": len(combined),
|
|
"window_start": since,
|
|
"window_end": until,
|
|
"time_detected": time_detected,
|
|
"by_severity": by_severity,
|
|
"by_source": by_source,
|
|
},
|
|
"reasoning": reasoning,
|
|
"entries": combined,
|
|
}
|
|
|
|
|
|
async def diagnose_stream(
|
|
db_path: Path,
|
|
query: str,
|
|
since: str | None = None,
|
|
until: str | None = None,
|
|
source_filter: str | None = None,
|
|
llm_url: str | None = None,
|
|
llm_model: str | None = None,
|
|
llm_api_key: str | None = None,
|
|
) -> AsyncGenerator[dict[str, Any], None]:
|
|
"""Async generator yielding SSE event dicts for the diagnose pipeline.
|
|
|
|
Yields events in order:
|
|
{"type":"status","message":"…"} — pipeline progress
|
|
{"type":"summary","data":{…}} — window + severity counts (fast, from DB)
|
|
{"type":"entries","data":[…]} — log entries (fast, from DB)
|
|
{"type":"reasoning","text":"…"} — LLM analysis (slow, optional)
|
|
{"type":"done"}
|
|
"""
|
|
keywords = query.strip()
|
|
source_browse = not keywords and source_filter is not None
|
|
|
|
if source_browse:
|
|
# No keyword — browsing a source directly. Use 24h window; skip FTS entirely.
|
|
yield {"type": "status", "message": f"Loading {source_filter}…"}
|
|
since = since or _last_n_minutes(60 * 24)
|
|
until = until or _now_iso()
|
|
time_detected = False
|
|
else:
|
|
yield {"type": "status", "message": "Parsing time window…"}
|
|
time_detected = since is not None and until is not None
|
|
if not time_detected:
|
|
parsed_since, parsed_until, keywords = await asyncio.to_thread(parse_time_window, query)
|
|
since = since or parsed_since
|
|
until = until or parsed_until
|
|
time_detected = keywords != query
|
|
|
|
yield {"type": "status", "message": "Searching logs…"}
|
|
|
|
if source_browse:
|
|
keyword_hits: list[SearchResult] = []
|
|
window_hits = await asyncio.to_thread(
|
|
lambda: entries_in_window(
|
|
db_path, since, until,
|
|
source_filter=source_filter, limit=200,
|
|
)
|
|
)
|
|
else:
|
|
keyword_hits, window_hits = await asyncio.gather(
|
|
asyncio.to_thread(
|
|
lambda: search(
|
|
db_path, keywords,
|
|
source_filter=source_filter, since=since, until=until,
|
|
limit=150, or_mode=True,
|
|
)
|
|
),
|
|
asyncio.to_thread(
|
|
lambda: entries_in_window(
|
|
db_path, since, until,
|
|
source_filter=source_filter, limit=50, per_source_cap=15,
|
|
)
|
|
),
|
|
)
|
|
|
|
seen: set[str] = set()
|
|
merged: list[SearchResult] = []
|
|
for r in keyword_hits + window_hits:
|
|
if r.entry_id not in seen:
|
|
seen.add(r.entry_id)
|
|
merged.append(r)
|
|
|
|
combined = sorted(merged, key=lambda r: (r.timestamp_iso or "\xff", r.sequence))[:200]
|
|
|
|
by_severity: dict[str, int] = {"CRITICAL": 0, "ERROR": 0, "WARN": 0, "INFO": 0}
|
|
by_source: dict[str, int] = {}
|
|
for r in combined:
|
|
sev = (r.severity or "INFO").upper()
|
|
if sev in by_severity:
|
|
by_severity[sev] += 1
|
|
by_source[r.source_id] = by_source.get(r.source_id, 0) + 1
|
|
|
|
yield {
|
|
"type": "summary",
|
|
"data": {
|
|
"total": len(combined),
|
|
"window_start": since,
|
|
"window_end": until,
|
|
"time_detected": time_detected,
|
|
"by_severity": by_severity,
|
|
"by_source": by_source,
|
|
},
|
|
}
|
|
yield {"type": "entries", "data": [dataclasses.asdict(r) for r in combined]}
|
|
|
|
if llm_url and llm_model and combined:
|
|
yield {"type": "status", "message": "Analyzing with LLM…"}
|
|
reasoning = await asyncio.to_thread(
|
|
lambda: summarize(query, combined, llm_url, llm_model, llm_api_key)
|
|
)
|
|
if reasoning:
|
|
yield {"type": "reasoning", "text": reasoning}
|
|
|
|
yield {"type": "done"}
|
|
|
|
|
|
def _now_iso() -> str:
|
|
return datetime.now(timezone.utc).isoformat()
|
|
|
|
|
|
def _last_n_minutes(n: int) -> str:
|
|
return (datetime.now(timezone.utc) - timedelta(minutes=n)).isoformat()
|