parser.py

'''
Used for normalizing parsed lines indicated by pattern/regex
'''

from patterns import patterns

def detect_format(lines):

    scores = {p["name"]: 0 for p in patterns}

    for line in lines:
        for p in patterns:
            if p["regex"].match(line):
                scores[p["name"]] += 1

    detected = max(scores, key=scores.get)
    return detected

def normalize(parsed, pattern_name):

    # Result set for patterns
    result = {
        "timestamp": parsed.get("timestamp"),
        "level": parsed.get("level"),
        "message": parsed.get("message"),
        "source": pattern_name
    }

    # Web logs detecting through status codes
    if pattern_name == "web_server":
        status = int(parsed.get("status", 200))

        if status >= 500:
            result["level"] = "ERROR"
        elif status >= 400:
            result["level"] = "WARNING"
        else:
            result["level"] = "INFO"
        
        result["message"] = f"HTTP {status} {parsed.get('path')}"
    
    # Syslogs doesn't always have explicit levels
    if pattern_name == "sys_log":
        msg = parsed.get("message", "")

        if "error" in msg.lower():
            result["level"] = "ERROR"
        elif "warn" in msg.lower():
            result["level"] = "WARNING"
        else:
            result["level"] = "INFO"
    return result

# Parses lines through patterns and normalizes them to readable
def parse_line(line):
    for pattern in patterns:
        match = pattern["regex"].match(line)

        if match:
            parsed = match.groupdict()
            return normalize(parsed, pattern["name"])
    
    return None