log_filters.md

Log Filtering

This is a filter/rating class to look at log objects and decide if they're interesting (worthy of review). Error messages are rated higher, as are logs from production hosts.

'use strict'

module.exports = function(options) {
  var my = {};

  my.config = {
    some_option: '',
    some_other_option: ''
  };

  // Merge options and config.
  if ( typeof options != 'undefined' ) {
    for(var attrname in my.config) {
      if ( typeof options[attrname] != 'undefined' ) {
        my.config[attrname] = options[attrname];
      }
    }
  };

  my.filters = [
    {
      name: 'Level Filter',
      filter: function(log) {
        switch(log.level) {
          case 'DEBUG':
            return 0;
            break;
          case 'INFO':
            return 10;
            break;
          case 'WARNING':
          case 'WARN':
            return 20;
            break;
          case 'ERROR':
            return 50;
            break;
          default:
            return 25;
            break;
        }
      }
    },
    {
      name: 'Host Filter',
      filter: function(log){
        switch(log.host) {
          case 'devhost':
          case 'devhost.example.com':
            return 0;
            break;
          case 'not-quite-dev-host':
            return 10;
            break;
          case 'prod':
          case 'prodhost.example.com':
            return 50;
            break;
          default:
            return 25;
            break;
        }
      }
    },
    {
      name: 'agent filter',
      filter: function(log){
        if ( log.facility == 'agent' && log.level != 'ERROR' ) {
          return -100;
        }
      }
    },
    {
      name: 'filter out of sequence logs',
      filter: function(log){
        if ( log.message.match(/ORA-01002: fetch out of sequence/g) ) {
          return -100;
        }
      }
    },
    {
      name: 'Filter file does not exist',
      filter: function(log){
        if ( log.message.match(/^File does not exist:/) ) {
          return -100;
        }
      }
    },
    {
      name: 'Filter array sizes inconsistent',
      filter: function(log){
        if ( log.message.match(/array_multisort\(\): Array sizes are inconsistent/) ) {
          return -100;
        }
      }
    },
    {
      name: 'Filter InfluxDB Errors',
      filter: function(log){
        if ( log.facility == 'api-measures' && log.message == 'InfluxDN Request returned status code 500' ) {
          return -50;
        }
      }
    }
  ];

  /** Rate a log, based on filters. Higher ratings are more intersting.
   *
   * @param {Object} log - Log to rate
   * @api public
   */
  my.rate = function(log) {
    var rating = 0;

    if ( typeof log == 'undefined' ) {
      return -100;
    }

    my.filters.forEach(function(filter){
      var value = filter.filter(log);
      var valInt = isNaN(value) ? 0 : value;
      rating = rating + valInt;
    });

    return rating;
  }

  return my;
}