Collector implementation

proto/logtail.proto

@@ -0,0 +1,82 @@
+syntax = "proto3";
+
+package logtail;
+
+option go_package = "git.ipng.ch/ipng/nginx-logtail/proto/logtailpb";
+
+// Filter restricts results to entries matching all specified fields.
+// Unset fields match everything.
+message Filter {
+  optional string website          = 1;
+  optional string client_prefix    = 2;
+  optional string http_request_uri = 3;
+  optional int32  http_response    = 4;
+}
+
+enum GroupBy {
+  WEBSITE      = 0;
+  CLIENT_PREFIX = 1;
+  REQUEST_URI  = 2;
+  HTTP_RESPONSE = 3;
+}
+
+enum Window {
+  W1M  = 0;   // last 1 minute
+  W5M  = 1;   // last 5 minutes
+  W15M = 2;   // last 15 minutes
+  W60M = 3;   // last 60 minutes
+  W6H  = 4;   // last 6 hours
+  W24H = 5;   // last 24 hours
+}
+
+// TopN
+
+message TopNRequest {
+  Filter  filter   = 1;
+  GroupBy group_by = 2;
+  int32   n        = 3;
+  Window  window   = 4;
+}
+
+message TopNEntry {
+  string label = 1;
+  int64  count = 2;
+}
+
+message TopNResponse {
+  repeated TopNEntry entries = 1;
+  string             source  = 2; // hostname of the responding node
+}
+
+// Trend — one total count per bucket, for sparklines
+
+message TrendRequest {
+  Filter filter = 1;
+  Window window = 2;
+}
+
+message TrendPoint {
+  int64 timestamp_unix = 1;
+  int64 count          = 2;
+}
+
+message TrendResponse {
+  repeated TrendPoint points = 1;
+  string              source = 2;
+}
+
+// StreamSnapshots — pushed by collector after every minute rotation
+
+message SnapshotRequest {}
+
+message Snapshot {
+  string             source    = 1;
+  int64              timestamp = 2;
+  repeated TopNEntry entries   = 3; // top-50K for this 1-minute bucket, sorted desc
+}
+
+service LogtailService {
+  rpc TopN            (TopNRequest)      returns (TopNResponse);
+  rpc Trend           (TrendRequest)     returns (TrendResponse);
+  rpc StreamSnapshots (SnapshotRequest)  returns (stream Snapshot);
+}