bvandeusenandClaude Opus 5.5
8eae3d3825
A pattern (phrases, a severity, a source, a window) is counted every minute into plugin_metrics as lines_matching_<key> per added source, zero included, so an ordinary alert rule fires on a match and clears once the window passes. Each count reads only the lines stored since the last, by line id; a new or changed pattern reads its window once. Patterns page with ready-made storage-trouble presets and "Alert on it", which opens the rule form aimed at the count. Source names are kept unique, and a rename moves its counts and the rules on them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
1.3 KiB
Python
36 lines
1.3 KiB
Python
"""Syslog: telling phrases counted per source into the metric store (#6001)
|
|
|
|
Revision ID: syslog_002_patterns
|
|
Revises: syslog_001_sources_lines
|
|
Create Date: 2026-10-19
|
|
"""
|
|
from typing import Sequence, Union
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
|
|
revision: str = "syslog_002_patterns"
|
|
down_revision: Union[str, None] = "syslog_001_sources_lines"
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.create_table(
|
|
"syslog_patterns",
|
|
sa.Column("id", sa.String(36), primary_key=True),
|
|
sa.Column("key", sa.String(48), nullable=False, unique=True),
|
|
sa.Column("name", sa.String(100), nullable=False),
|
|
sa.Column("phrases", sa.JSON, nullable=False),
|
|
sa.Column("max_severity", sa.SmallInteger, nullable=True),
|
|
sa.Column("source_id", sa.String(36),
|
|
sa.ForeignKey("syslog_sources.id", ondelete="CASCADE"), nullable=True),
|
|
sa.Column("window_minutes", sa.SmallInteger, nullable=False, server_default="15"),
|
|
sa.Column("enabled", sa.Boolean, nullable=False, server_default=sa.true()),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_table("syslog_patterns")
|