syntax = "proto3";

package logtail;

option go_package = "git.ipng.ch/ipng/nginx-logtail/proto/logtailpb";

// StatusOp is the comparison operator applied to http_response in a Filter.
// Defaults to EQ (exact match) for backward compatibility.
enum StatusOp {
  EQ = 0;  // ==
  NE = 1;  // !=
  GT = 2;  // >
  GE = 3;  // >=
  LT = 4;  // <
  LE = 5;  // <=
}

// Filter restricts results to entries matching all specified fields.
// Unset fields match everything. Exact-match and regex fields are ANDed.
message Filter {
  optional string website            = 1;
  optional string client_prefix      = 2;
  optional string http_request_uri   = 3;
  optional int32  http_response      = 4;
  StatusOp        status_op          = 5;  // operator for http_response; ignored when unset
  optional string website_regex      = 6;  // RE2 regex matched against website
  optional string uri_regex          = 7;  // RE2 regex matched against http_request_uri
}

enum GroupBy {
  WEBSITE      = 0;
  CLIENT_PREFIX = 1;
  REQUEST_URI  = 2;
  HTTP_RESPONSE = 3;
}

enum Window {
  W1M  = 0;   // last 1 minute
  W5M  = 1;   // last 5 minutes
  W15M = 2;   // last 15 minutes
  W60M = 3;   // last 60 minutes
  W6H  = 4;   // last 6 hours
  W24H = 5;   // last 24 hours
}

// TopN

message TopNRequest {
  Filter  filter   = 1;
  GroupBy group_by = 2;
  int32   n        = 3;
  Window  window   = 4;
}

message TopNEntry {
  string label = 1;
  int64  count = 2;
}

message TopNResponse {
  repeated TopNEntry entries = 1;
  string             source  = 2; // hostname of the responding node
}

// Trend — one total count per bucket, for sparklines

message TrendRequest {
  Filter filter = 1;
  Window window = 2;
}

message TrendPoint {
  int64 timestamp_unix = 1;
  int64 count          = 2;
}

message TrendResponse {
  repeated TrendPoint points = 1;
  string              source = 2;
}

// StreamSnapshots — pushed by collector after every minute rotation

message SnapshotRequest {}

message Snapshot {
  string             source    = 1;
  int64              timestamp = 2;
  repeated TopNEntry entries   = 3; // top-50K for this 1-minute bucket, sorted desc
}

service LogtailService {
  rpc TopN            (TopNRequest)      returns (TopNResponse);
  rpc Trend           (TrendRequest)     returns (TrendResponse);
  rpc StreamSnapshots (SnapshotRequest)  returns (stream Snapshot);
}