Adding parselogs

Adding the parselogs utility

Author: mattmendick

.gitignore

@@ -6,3 +6,4 @@ cmd/chunktool/chunktool
 images/
 dist/
 .DS_STORE
+cmd/parselogs/parselogs

cmd/parselogs/Makefile

@@ -0,0 +1,6 @@
+all: build-bin
+
+build-bin:
+	GO111MODULE=on go build -o parselogs -v ./
+
+build: build-bin

cmd/parselogs/README.md

@@ -0,0 +1,23 @@
+# parselogs
+
+A cli tool to parse Cortex query-frontend logs and format them for easy analysis.
+
+```
+Options:
+  -dur duration
+        only show queries which took longer than this duration, e.g. -dur 10s
+  -query
+        show the query
+  -utc
+        show timestamp in UTC time
+```
+
+Feed logs into it using `logcli` from Loki, `kubectl` from Kubernetes, `cat` from a file, or any other way to get raw logs:
+
+```
+$ cat query-frontend-logs.log | ./parselogs -dur 5s
+Timestamp                                TraceID           Length    Duration       Status  Path
+2020-05-26 13:51:15.0577354 -0400 EDT    76b9939fd5c78b8f  6h0m0s    10.249149614s  (200)   /api/prom/api/v1/query_range
+2020-05-26 13:52:15.771988849 -0400 EDT  2e7473ab10160630  10h33m0s  7.472855362s   (200)   /api/prom/api/v1/query_range
+2020-05-26 13:53:46.712563497 -0400 EDT  761f3221dcdd85de  10h33m0s  11.874296689s  (200)   /api/prom/api/v1/query_range
+```

cmd/parselogs/main.go

@@ -0,0 +1,151 @@
+package main
+
+import (
+	"bufio"
+	"flag"
+	"fmt"
+	"net/url"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+	"text/tabwriter"
+	"time"
+)
+
+var (
+	rex    = regexp.MustCompile("(\\S+)=(\".*?\"|\\S+)")
+	layout = "2006-01-02T15:04:05.999999999Z"
+)
+
+func main() {
+
+	fi, _ := os.Stdin.Stat()
+	isPipe := false
+	if (fi.Mode() & os.ModeCharDevice) == 0 {
+		isPipe = true
+	}
+
+	showQuery := flag.Bool("query", false, "show the query")
+	minDur := flag.Duration("dur", 0, "only show queries which took longer than this duration, e.g. 10s")
+	utc := flag.Bool("utc", false, "show timestamp in UTC time")
+	flag.Parse()
+
+	// use tabwriter to format the output spaced out
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+
+	// headings
+	if *showQuery {
+		fmt.Fprintf(w, "Timestamp\tTraceID\tLength\tDuration\tStatus\tPath\tQuery\n")
+	} else {
+		fmt.Fprintf(w, "Timestamp\tTraceID\tLength\tDuration\tStatus\tPath\n")
+	}
+
+	scanner := bufio.NewScanner(os.Stdin)
+	for scanner.Scan() {
+		show := false
+		var qt time.Time
+		var dur, len time.Duration
+		var status, path, query, trace string
+		var err error
+
+		line := scanner.Text()
+		data := rex.FindAllStringSubmatch(line, -1)
+
+		for _, d := range data {
+			switch d[1] {
+			case "traceID":
+				trace = d[2]
+			case "ts":
+				qt, err = time.Parse(layout, d[2])
+				if err != nil {
+					fmt.Println(err, line)
+					continue
+				}
+			case "msg":
+				msg := strings.ReplaceAll(d[2], "\"", "")
+				if !(strings.HasPrefix(msg, "GET /loki/api/") ||
+					strings.HasPrefix(msg, "GET /api/prom")) {
+					continue
+				}
+
+				show = true
+
+				parts := strings.Split(msg, " ")
+				u, err := url.Parse(parts[1])
+				if err != nil {
+					fmt.Println(err, line)
+					continue
+				}
+				vals, err := url.ParseQuery(u.RawQuery)
+				if err != nil {
+					fmt.Println(err, line)
+					continue
+				}
+				start := vals.Get("start")
+				end := vals.Get("end")
+
+				if start != "" && end != "" {
+					var st, et int64
+					//First try to parse as unix sec timestamps
+					st, err = strconv.ParseInt(start, 10, 64)
+					et, err = strconv.ParseInt(end, 10, 64)
+					if err != nil {
+						//Next try to parse as time/date
+						var st, et time.Time
+						st, err = time.Parse(layout, start)
+						et, err = time.Parse(layout, end)
+						if err != nil {
+							fmt.Println(err, line)
+							continue
+						}
+						len = et.Sub(st)
+					} else {
+						// Loki queries are nanosecond, simple check to see if it's a second or nanosecond timestamp
+						if st > 9999999999 {
+							len = time.Unix(0, et).Sub(time.Unix(0, st))
+						} else {
+							len = time.Unix(et, 0).Sub(time.Unix(st, 0))
+						}
+
+					}
+
+				}
+
+				status = parts[2]
+				path = u.Path
+				query = vals.Get("query")
+
+				dur, err = time.ParseDuration(parts[3])
+				if err != nil {
+					fmt.Println(err, line)
+					continue
+				}
+			}
+		}
+
+		if show && dur > *minDur {
+			var ts string
+			if *utc {
+				ts = fmt.Sprint(qt)
+			} else {
+				ts = fmt.Sprint(qt.Local())
+			}
+			if *showQuery {
+				fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\t%v\t%v\n", ts, trace, len, dur, status, path, query)
+			} else {
+				fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\t%v\n", ts, trace, len, dur, status, path)
+			}
+			//If looking at stdin, flush after every line as someone would only paste one line at a time at the terminal
+			if !isPipe {
+				w.Flush()
+			}
+
+		}
+		show = false
+	}
+
+	fmt.Printf("\n")
+	w.Flush()
+
+}