FilesExpand file tree

 master

/

Sherlock

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

 master

/

Sherlock

/

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
static		static
Makefile		Makefile
README.md		README.md
dashboard.cc_		dashboard.cc_
design-doc.md		design-doc.md
exceptions.h		exceptions.h
port.h		port.h
pubsub.h		pubsub.h
replicator.h		replicator.h
sherlock.h		sherlock.h
stream_data.h		stream_data.h
test.cc		test.cc
View all files

README.md

HTTP Logs Access Cheatsheet

1. Test connectivity: /raw_log/schema.md
   1. Also try .json, .fs, .cpp.
2. Number of entries in the log: /raw_log?sizeonly
   1. Or HEAD instead of GET, to get the response in the header.
3. When don't need an infinite stream (i.e., when -f is not required from this tail, ex. from the browser):
   1. TL;DR: Add &nowait.
   2. Alternate means of capping the output: &n=, &period=, and &stop_after_bytes=.
4. When in the browser, add &array. This makes the whole output "page" a valid JSON.
5. A milder version of &array is &entries_only.
   1. Without &entries_only or &array, it's going to be one log entry per line as two tab-separated JSONs.
   2. The first tab-column of the full output is the way to get the true timestamp of the log event.
   3. Timestamps and periods are generally epoch microseconds (use date -d "yesterday" +"%s000000", with six zeroes at the end, to create one. Unless you're on OS X, in which case sorry.)
6. Reference access patterns:
   1. /raw_log?tail=1&nowait
   2. /raw_log?tail=100&array&nowait
   3. /raw_log?i=1000000&n=100
   4. /raw_log?i=1000000&nowait
   5. /raw_log?i=100&period=100000000&array
   6. /raw_log?since=1473380843835579&stop_after_bytes=10000&array
7. JSON formats:
   1. &json=js for JavaScript-friendly JSONs (no numerical type ID), and
   2. &json=fs for F#-friendly JSONs (see the /raw_log/schema.fs above).
8. Recap for /raw_log:
   1. Left boundary: &i=<index> | &since=<microseconds timestamp> | &tail=<index starting from the end> | &recent=<same as tail but in microseconds instead of indexes>.
   2. Right boundary: &n=<count> | &period=<microseconds range> | &stop_after_bytes=<bytes> | &nowait.
   3. JSON layout: &json=js hides type IDs, and &json=fs is F#-friendly.
   4. Default format is one event per line, as two '\t'-separated JSONs: {index,timestamp} and event body. &entries_only surpasses the 1st col, and &array, makes the output one large JSON array of the 2nd col.
   5. Special endpoints: ?sizeonly for the todal number of entries, and /raw_low/schema.{json,cpp,fs,h} for the schema.