Quick start

Task: find requests in access.log that failed on the server or took more than 1.5 seconds, and report how many lines could not be parsed.

The full example#

import { createReadStream } from 'node:fs';
import { createParser } from 'sverlo';

const parser = createParser({ format: 'nginx-combined', onError: 'collect' });
const slow = parser.query('status>=500 OR request_time>1.5');

let hits = 0;
for await (const rec of parser.stream(createReadStream('access.log'))) {
  if (!slow(rec)) continue;
  hits++;
  console.log(rec.ts.toISOString(), rec.fields.status, rec.fields.path);
}
console.log(`slow or failed: ${hits}, unparsed: ${parser.errors.length}`);

The file example-basic.mjs lives in this site's includes directory and is pulled in with a directive, so the example in the docs cannot drift from the checked code.

Step by step#

1. createParser({ format: 'nginx-combined' }) builds a parser. The pattern is compiled once; every line then takes a single pass.
2. onError: 'collect' stores unrecognised lines in parser.errors instead of throwing.
3. parser.query(...) compiles a query into a plain (record) => boolean function.
4. parser.stream(readable) returns an async iterator of records. The file is read in chunks and memory does not grow with the log.

sverlo parse access.log --format nginx-combined \
  --query 'status>=500 OR request_time>1.5' --out count

What next#

• Your own line format: patterns.
• Large inputs: streaming.