--- title: "Validate" description: "How log10x_validate runs your candidate config, and how to reproduce\ \ a failing run locally" source: "https://github.com/log-10x/modules/tree/main/pipelines/mcp/app.yaml" icon: "material/play-circle-outline" --- When an agent calls `log10x_validate`, the server spawns `tenx @apps/mcp` as a subprocess. The subprocess reads log lines on stdin and writes `TenXObject`s + `TenXTemplate`s as JSON lines on stdout. No filesystem, no network. The server parses the output and returns it to the agent. You almost never invoke `@apps/mcp` directly, the server handles the subprocess lifecycle. This page exists for debugging: when `log10x_validate` returns something unexpected and you want to see exactly what the engine did with your candidate config. ## Reproduce a `log10x_validate` run locally Pipe the same log lines the agent piped, against the same candidate config: ```bash echo "" | tenx @apps/mcp ``` Stack your candidate config after the base app: ```bash echo "" | tenx @apps/mcp @/path/to/your-config.yaml ``` The stdout is exactly what `log10x_validate` returned to the agent. Diff against the agent's reported output to find where they diverge, typically either (a) the agent's interpretation of the output, or (b) a config stacking order issue. ## Why `@apps/mcp` is narrower than `@apps/dev` `@apps/mcp` omits `httpCode` and `lookup` enrichment because their embedded scripts reference engine builtins that move between releases. Keeping the validate runtime pinned to stable primitives means `log10x_validate` behaves consistently across engine upgrades, agents get the same answer in March as they did in January. If you need richer enrichment for local exploration (the full pipeline including HTTP code classification and lookup tables), use [Dev](https://doc.log10x.com/apps/dev/ "Test and validate log, symbol library and config files locally") directly instead of `@apps/mcp`. ## :material-wrench-outline: Config Files To configure the MCP test-drive app, [:material-cog: Edit](https://doc.log10x.com/config/app/#main-config "Learn how to edit app and module configurations") these files: ??? tenx-mainconfig "Main Config" ### Main Config {.hidden-heading} The main config file loads the MCP test-drive app's required modules. Uncomment selected modules at: [mcp/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/apps/mcp/config.yaml "mcp/config.yaml"){target="\_blank"}.

Edit Online

```yaml # # 🔟❎ MCP-driven test-drive app # # A stdin/stdout-only variant of @apps/dev. Every I/O channel that @apps/dev # routes through the filesystem (input file, output dirs, dev browser) is # replaced here by the process's stdin/stdout, so an MCP tool can pipe log # lines in, receive TenXObject + TenXTemplate output, and never touch disk. # # Intended single invocation: # # echo "" | tenx @apps/mcp [@] # # The caller can stack an additional @ that adds modules, constructors, # or filters to be validated alongside this app — that file is mounted by # the CLI alongside this config. # # To learn more see https://doc.log10x.com/apps/dev (the @apps/dev sibling). tenx: run # Where the engine validates its licence (/api/v1/agent/whoami) and ships # its metrics (/api/v1/write). One endpoint drives BOTH: repointing it for # licensing also repoints metrics delivery. Unset or empty, the engine has # no address to call: metrics stay local and the licence verifies offline. backendEndpoint: $=TenXEnv.get("TENX_BACKEND_ENDPOINT", "") runtimeName: $=TenXEnv.get("TENX_RUNTIME_NAME", "myMcp") # ============================ Load App Modules =============================== include: # ------------------------------ App settings --------------------------------- # Load general app settings from modules/apps/mcp. - mcp # ------------------------------ Input: stdin ------------------------------- # Open stdin as the pipeline's only input. stdinEnabled defaults to true # in the module, but set explicitly below so a caller passing `-in false` # can suppress it without having to override two variables. - run/input/stdin # https://doc.log10x.com/run/input/stdin # --------------------------- Enrich TenXObjects ---------------------------- # Minimal enrichment chain: level + group + message. Enough for template # extraction and timestamp classification, which is what most validation # tests need. Deliberately omits `httpCode` and `lookup` because their # embedded scripts reference engine builtins (e.g. findTokenNear) that # vary between engine versions and would force the caller onto a # specific CLI vintage. - run/initialize/inputField # https://doc.log10x.com/run/initialize/#inputfield - run/initialize/level # https://doc.log10x.com/run/initialize/level - run/initialize/group # https://doc.log10x.com/run/initialize/group - run/initialize/message # https://doc.log10x.com/run/initialize/message # `custom` auto-discovers user-supplied object constructors (e.g., a # GeoRefCityObject-style `TenXObject`-extender, or a debug logger) from # whatever .js files the caller mounts under an included directory. - run/initialize/custom # https://doc.log10x.com/run/transform/script/object # ------------------------------ Output: stdout ----------------------------- # Forked stdout config with per-line prefixes the MCP wrapper demuxes: # `~` → encoded event, `{` → template JSON, `summary=` → aggregate. - apps/mcp/stdout # ============================== Runtime args ================================ # Force stdin + stdout on by default. Both can still be toggled from the # command line (`-stdinEnabled false`, `-stdoutWriteObjects false`). stdoutTarget: SYSTEM_OUT stdoutWriteObjects: true # Do NOT set `quiet: true` here (unlike @apps/retriever/*). The whole # point of @apps/mcp is surfacing TenXConsole.log / TenXLog.info output so # validation can inspect runtime-side assertions. ``` ??? tenx-inputs "Inputs" ### Inputs {.hidden-heading} Activate [Event inputs](/run/input "Read events into the pipeline from local and remote sources") to read events from local/remote sources to transform into TenXObjects. Below is the default configuration from: [stdin/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/input/stdin/config.yaml "stdin/config.yaml"){target="\_blank"}.

Edit Online

```yaml # 🔟❎ 'run' Stdin input configuration # Configure a stdin event input. To learn more see https://doc.log10x.com/run/input/stdin/ # Set the 10x pipeline to 'run' tenx: run # =============================== Dependencies ================================ include: run/modules/input/stdin # =============================== Stdin Options =============================== # NOTE: a pipeline should configure no more than a single stdin input stdin: enabled: true # ---------------------------- Parsing Options ---------------------------- # 'extractors' defines a list of JSON/regex extractor names # used to capture and redact event values from 'path' to transform # into TenXObjects. To learn more see: https://doc.log10x.com/run/input/extract extractors: [ ] # 'sourcePattern' defines a regex pattern that captures a 'source' value # for each event read from the file and transformed into an TenXObject. # This value will be used to sequence all events sharing this 'source' value correctly # so they are not mixed with events originating from different locations. sourcePattern: null ``` ??? tenx-initializers "Initializers" ### Initializers {.hidden-heading} Activate an [Object initializer](/run/initialize "Enrich TenXObjects with additional context") to enrich TenXObjects with additional context. === ":material-origin: Message" #### message {.hidden-heading} Configure the [Symbol Message Calculator](/run/initialize/message "Enrich TenXObjects with logical message symbol sequence and origin values") to enrich TenXObjects with logical message symbol sequence and origin values. Below is the default configuration from: [message/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/initialize/message/config.yaml "message/config.yaml"){target="\_blank"}.

Edit Online

```yaml # 🔟❎ 'run' symbol lookup configuration # Configure a symbol origin lookup to enrich TenXObjects # To learn more see https://doc.log10x.com/run/initialize/message/ # Set the 10x pipeline to 'run' tenx: run # =============================== Dependencies ================================ include: run/modules/initialize/message # ============================== Symbol Options =============================== symbol: # 'types' specifies the types of symbols that participate in the origin search. The listed # contexts are evaluated in a single pass, so list order acts as a filter rather than a precedence chain. # Supported values (case insensitive), PACKAGE, CLASS, METHOD, LOG, ENUM, CONST, TEXT, EXEC, ANY # To learn more see https://doc.log10x.com/run/transform/symbol/#contexts contexts: log,exec # 'messageField' specifies the field name to assign the message pattern to target TenXObjects: the symbol # tokens of the origin ranked highest by coverage, meaning the count of distinct library-known tokens it # explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'. messageField: message_pattern # 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key. # # Left unset on purpose. The hash enrichment is always computed and carried on the TenXObject under # its internal name 'tenx_hash', so metric dimensions, the aggregation key and the MCP artifacts are # unaffected. Setting this key is what names the field on the wire, and on the forwarder receive path # that is also what puts it on the record returned to the forwarder; leave it unset and the forwarder # gets its record back byte-for-byte. Uncomment and name a field to opt in: # # messageHashField: tenx_hash # 'maxLen' specifies the max char len of the output messageField maxLen: 120 # ============================== Message Options ============================== # 'negators' specifies patterns that mark a log line as boilerplate/continuation (stack trace frames, # indented detail, banners) so the message-template skips its own message-pattern compute for them. # The check fires only for templates that don't already pass the (groupSize > 1) || groupHead arms; # i.e., for single-event templates with no head signal. A non-negator line in that case (e.g., bare # "Hello World", "Heartbeat received from node-7") still gets a pattern; a negator-matching orphan # (e.g., a lone "\tat com.foo.Bar(...)") does not. message: negators: - " " # any indented line (stack frames, indented app detail, multi-line JSON, banners) - "\t" # real tab byte, for msgpack/forward inputs that preserve raw whitespace - "\\t" # literal backslash+t, for file/JSON inputs that keep escape sequences raw - "Caused by: " # Java chained exception (column 0) - "Suppressed: " # Java suppressed exception (column 0) - "--- End of " # .NET inner exception marker (column 0) - "created by " # Go goroutine creator (column 0) - "#0 " # PHP stack frame depth 0 - "#1 " # PHP stack frame depth 1 - "#2 " # PHP stack frame depth 2 - "#3 " # PHP stack frame depth 3 - "#4 " # PHP stack frame depth 4 - "#5 " # PHP stack frame depth 5 ``` === ":material-information-outline: Level" #### level {.hidden-heading} Configure the [Level Classifier](/run/initialize/level "Classify TenXObjects with a severity level") to classify TenXObjects with a severity level. Below is the default configuration from: [level/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/initialize/level/config.yaml "level/config.yaml"){target="\_blank"}.

Edit Online

```yaml # 🔟❎ 'run' level classifier configuration # Configuration level classifier to enrich TenXObjects # To learn more see https://doc.log10x.com/run/initialize/level/ # Set the 10x pipeline to 'run' tenx: run # =============================== Dependencies ================================ include: run/modules/initialize/level # =============================== Level Options =============================== level: # 'field' specify the field name to assign with the inferred severity level field: severity_level # 'terms' specify severity level classification, start-of-line matching # Used to identify the severity level (TRACE, DEBUG, INFO, WARN, ERROR, CRITICAL) of a log line, typically marking # the start of a log event (head). Sorted by likelihood and uniqueness. Used in a Trie for O(m) matching. terms: - 'trace=TRACE' # Common in JavaScript (Winston) or custom logs; e.g., "trace Variable x = 5" - 'Trace=TRACE' # Mixed case; e.g., "Trace Variable x = 5" - 'TRACE=TRACE' # Uppercase, less common; e.g., "TRACE Message" - 'debug=DEBUG' # Common in JavaScript (Winston) or custom logs; e.g., "debug Entering method foo" - 'Debug=DEBUG' # Mixed case; e.g., "Debug Entering method foo" - 'DEBUG=DEBUG' # Uppercase; e.g., "DEBUG Message" - 'DBG=DEBUG' # Abbreviation, less common; e.g., "DBG Entering method foo" - 'info=INFO' # Common in JavaScript (Winston) or custom logs; e.g., "info Application started" - 'Info=INFO' # Mixed case; e.g., "Info Application started" - 'INFO=INFO' # Uppercase; e.g., "INFO Message" - 'notice=INFO' # Common in custom logs or lowercase syslog; e.g., "notice Configuration updated" - 'Notice=INFO' # Mixed case; e.g., "Notice Configuration updated" - 'NOTICE=INFO' # Uppercase, syslog; e.g., "NOTICE Message" - 'warn=WARN' # Common in JavaScript (Winston) or custom logs; e.g., "warn Low disk space" - 'Warn=WARN' # Mixed case; e.g., "Warn Low disk space" - 'WARN=WARN' # Uppercase; e.g., "WARN Message" - 'warning=WARN' # Common in custom logs or verbose frameworks; e.g., "warning Low disk space" - 'Warning=WARN' # Mixed case; e.g., "Warning Low disk space" - 'WARNING=WARN' # Uppercase; e.g., "WARNING Message" - 'error=ERROR' # Common in JavaScript (Winston) or custom logs; e.g., "error Failed to connect" - 'Error=ERROR' # Mixed case; e.g., "Error Failed to connect" - 'ERROR=ERROR' # Uppercase; e.g., "ERROR Message" - 'err=ERROR' # Lowercase abbreviation; e.g., "err Failed to connect" - 'ERR=ERROR' # Uppercase abbreviation; e.g., "ERR Message" - 'TypeError=ERROR' # JavaScript, stack trace; e.g., "TypeError: undefined is not a function" - 'ReferenceError=ERROR' # JavaScript, stack trace; e.g., "ReferenceError: x is not defined" - 'ValueError=ERROR' # Python, stack trace; e.g., "ValueError: invalid literal" - 'PHP_Warning=ERROR' # PHP, warning message; e.g., "PHP Warning: Undefined variable" - 'fatal=CRITICAL' # Common in custom logs; e.g., "fatal System crash" - 'Fatal=CRITICAL' # Mixed case; e.g., "Fatal System crash" - 'FATAL=CRITICAL' # Uppercase; e.g., "FATAL Message" - 'critical=CRITICAL' # Common in custom logs; e.g., "critical System crash" - 'Critical=CRITICAL' # Mixed case; e.g., "Critical System crash" - 'CRITICAL=CRITICAL' # Uppercase; e.g., "CRITICAL Message" - 'crit=CRITICAL' # Lowercase abbreviation, syslog; e.g., "crit System crash" - 'CRIT=CRITICAL' # Uppercase abbreviation, syslog; e.g., "CRIT Message" - 'alert=CRITICAL' # Common in custom logs or syslog; e.g., "alert High CPU usage" - 'Alert=CRITICAL' # Mixed case; e.g., "Alert High CPU usage" - 'ALERT=CRITICAL' # Uppercase, syslog; e.g., "ALERT Message" - 'emerg=CRITICAL' # Common in custom logs or lowercase syslog; e.g., "emerg System unusable" - 'Emerg=CRITICAL' # Mixed case; e.g., "Emerg System unusable" - 'EMERG=CRITICAL' # Uppercase, syslog; e.g., "EMERG Message" - 'panic=CRITICAL' # Go panic, first line; e.g., "panic: runtime error: index out of range" - 'fatal_error=CRITICAL' # Go fatal error, first line; e.g., "fatal error: all goroutines are asleep" - 'thread_main_panicked_at=CRITICAL' # Rust panic, first line; e.g., "thread 'main' panicked at 'explicit panic'" - 'Segmentation_fault=CRITICAL' # C/C++ memory violation, first line; e.g., "Segmentation fault (core dumped)" - 'Aborted=CRITICAL' # C/C++ termination, first line; e.g., "Aborted (core dumped)" - 'Assertion_failed=CRITICAL' # C/C++ assertion failure, first line; e.g., "Assertion failed: x > 0" - 'PHP_Fatal_error=CRITICAL' # PHP fatal error, first line; e.g., "PHP Fatal error: Out of memory" - 'Traceback_most_recent_call_last=CRITICAL' # Python stack trace, first line; e.g., "Traceback (most recent call last)" - 'Stack_trace=CRITICAL' # Generic stack trace, first line; e.g., "Stack trace" - 'Error=CRITICAL' # JavaScript, stack trace; e.g., "Error: Something went wrong" - 'Fatal_error=CRITICAL' # PHP, stack trace; e.g., "Fatal error: Uncaught Exception" - 'Unhandled_exception=CRITICAL' # C#/Dart, stack trace; e.g., "Unhandled exception: System.NullReferenceException" - 'Exception_in_thread=CRITICAL' # Java, stack trace; e.g., "Exception in thread 'main' java.lang.RuntimeException" - 'goroutine=CRITICAL' # Go, stack trace; e.g., "goroutine 1 [running]:" - 'failed=ERROR' # ERROR-level entries in application, system, or web server logs # 'timestampPatterns' patterns for LogEvent head classification, start-of-line matching # Used to identify timestamp formats in log lines and infer their implied severity level based on the first character. # Formats are typical of Kubernetes kube-apiserver logs with varying microsecond precision. The first character # ('I', 'W', 'E', 'F') determines the severity: I=INFO, W=WARN, E=ERROR, F=CRITICAL. Sorted by precision. timestampPatterns: - "'I'MMdd HH:mm:ss.S=INFO" # Used in Kubernetes kube-apiserver logs with INFO prefix, 1-digit microsecond precision - "'I'MMdd HH:mm:ss.SS=INFO" # Used in Kubernetes kube-apiserver logs with INFO prefix, 2-digit microsecond precision - "'I'MMdd HH:mm:ss.SSS=INFO" # Used in Kubernetes kube-apiserver logs with INFO prefix, 3-digit microsecond precision - "'I'MMdd HH:mm:ss.SSSS=INFO" # Used in Kubernetes kube-apiserver logs with INFO prefix, 4-digit microsecond precision - "'I'MMdd HH:mm:ss.SSSSS=INFO" # Used in Kubernetes kube-apiserver logs with INFO prefix, 5-digit microsecond precision - "'I'MMdd HH:mm:ss.SSSSSS=INFO" # Used in Kubernetes kube-apiserver logs with INFO prefix, 6-digit microsecond precision - "'W'MMdd HH:mm:ss.S=WARN" # Used in Kubernetes kube-apiserver logs with WARNING prefix, 1-digit microsecond precision - "'W'MMdd HH:mm:ss.SS=WARN" # Used in Kubernetes kube-apiserver logs with WARNING prefix, 2-digit microsecond precision - "'W'MMdd HH:mm:ss.SSS=WARN" # Used in Kubernetes kube-apiserver logs with WARNING prefix, 3-digit microsecond precision - "'W'MMdd HH:mm:ss.SSSS=WARN" # Used in Kubernetes kube-apiserver logs with WARNING prefix, 4-digit microsecond precision - "'W'MMdd HH:mm:ss.SSSSS=WARN" # Used in Kubernetes kube-apiserver logs with WARNING prefix, 5-digit microsecond precision - "'W'MMdd HH:mm:ss.SSSSSS=WARN" # Used in Kubernetes kube-apiserver logs with WARNING prefix, 6-digit microsecond precision - "'E'MMdd HH:mm:ss.S=ERROR" # Used in Kubernetes kube-apiserver logs with ERROR prefix, 1-digit microsecond precision - "'E'MMdd HH:mm:ss.SS=ERROR" # Used in Kubernetes kube-apiserver logs with ERROR prefix, 2-digit microsecond precision - "'E'MMdd HH:mm:ss.SSS=ERROR" # Used in Kubernetes kube-apiserver logs with ERROR prefix, 3-digit microsecond precision - "'E'MMdd HH:mm:ss.SSSS=ERROR" # Used in Kubernetes kube-apiserver logs with ERROR prefix, 4-digit microsecond precision - "'E'MMdd HH:mm:ss.SSSSS=ERROR" # Used in Kubernetes kube-apiserver logs with ERROR prefix, 5-digit microsecond precision - "'E'MMdd HH:mm:ss.SSSSSS=ERROR" # Used in Kubernetes kube-apiserver logs with ERROR prefix, 6-digit microsecond precision - "'F'MMdd HH:mm:ss.S=CRITICAL" # Used in Kubernetes kube-apiserver logs with FATAL prefix, 1-digit microsecond precision - "'F'MMdd HH:mm:ss.SS=CRITICAL" # Used in Kubernetes kube-apiserver logs with FATAL prefix, 2-digit microsecond precision - "'F'MMdd HH:mm:ss.SSS=CRITICAL" # Used in Kubernetes kube-apiserver logs with FATAL prefix, 3-digit microsecond precision - "'F'MMdd HH:mm:ss.SSSS=CRITICAL" # Used in Kubernetes kube-apiserver logs with FATAL prefix, 4-digit microsecond precision - "'F'MMdd HH:mm:ss.SSSSS=CRITICAL" # Used in Kubernetes kube-apiserver logs with FATAL prefix, 5-digit microsecond precision - "'F'MMdd HH:mm:ss.SSSSSS=CRITICAL" # Used in Kubernetes kube-apiserver logs with FATAL prefix, 6-digit microsecond precision ``` === ":material-select-group: Group" #### group {.hidden-heading} Configure the [Group initializer](/run/initialize/group "Combine multi-line events into TenXObject group instances") to combine multi-line events into TenXObject group instances. Below is the default configuration from: [group/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/initialize/group/config.yaml "group/config.yaml"){target="\_blank"}.

Edit Online

```yaml # 🔟❎ 'run' event grouping configuration # Group sequences of TenXObjects to filter, aggregate and output as a single logical unit. # To learn more see https://doc.log10x.com/run/transform/group/ # Set the 10x pipeline to 'run' tenx: run # =============================== Dependencies ================================ include: run/modules/initialize/group # =============================== Group Options =============================== # 'indicators' specifies a list of `value:state` pairs that determine if a log line's start marks a group head (`true`) or child (`false`). group: # 'indicators' specifies a list of strings that, when matched at the start of a log line's text, designate it as a group head. # Unmatched lines default to false, indicating they are group children (continuation-by-default). indicators: - '{' # Indicates a pretty-printed JSON/object log body (e.g., payment '{ resource: {...} }'); the opening brace heads the multi-line object so it groups as one event. Matches the log body only, grouping reads inputField, not the wrapped envelope. - '192.' # Indicates a private IP address, common in web server logs (e.g., "192.168.1.1 - - [...]") - '10.' # Indicates a private IP range, often in Kubernetes or internal network logs (e.g., "10.244.0.125 - - [...]") - '172.' # Indicates a private IP range, typical in enterprise network logs (e.g., "172.16.0.1 - - [...]") - '127.' # Indicates localhost, a common web server log initiator (e.g., "127.0.0.1 - - [...]") - 'GET ' # Indicates an HTTP GET request, marking the start of a web transaction log (e.g., "GET /index.html HTTP/1.1") - 'POST ' # Indicates an HTTP POST request, marking the start of a web transaction log (e.g., "POST /api HTTP/1.1") - 'PUT ' # Indicates an HTTP PUT request, marking the start of a web transaction log (e.g., "PUT /resource HTTP/1.1") - 'DELETE ' # Indicates an HTTP DELETE request, marking the start of a web transaction log (e.g., "DELETE /resource HTTP/1.1") - 'HEAD ' # Indicates an HTTP HEAD request, marking the start of a web transaction log (e.g., "HEAD /index.html HTTP/1.1") - 'OPTIONS ' # Indicates an HTTP OPTIONS request, marking the start of a web transaction log (e.g., "OPTIONS /api HTTP/1.1") - 'HTTP/' # Indicates an HTTP protocol version, marking the start of a web transaction log (e.g., "GET /index.html HTTP/1.1") - 'kernel:' # Indicates a Linux kernel log entry, marking the start of a system event (e.g., "kernel: [0.123456] Device initialized") - 'sshd[' # Indicates an SSH daemon log entry, marking the start of a security event (e.g., "sshd[1234]: Accepted password ...") - 'systemd[' # Indicates a systemd service log entry, marking the start of a system service event (e.g., "systemd[1]: Started service ...") - 'cron[' # Indicates a cron daemon log entry, marking the start of a scheduled task event (e.g., "cron[1234]: Running job ...") - 'syslog:' # Indicates a syslog message, marking the start of a system log event (e.g., "syslog: Message ...") - 'rsyslogd:' # Indicates an rsyslog daemon log entry, marking the start of a logging system event (e.g., "rsyslogd: Log started ...") - 'auditd[' # Indicates an audit daemon log entry, marking the start of a security audit event (e.g., "auditd[1234]: Audit event ...") - 'daemon:' # Indicates a syslog daemon facility log, marking the start of a system service event (e.g., "daemon: Service started ...") - 'user:' # Indicates a syslog user facility log, marking the start of a user-related event (e.g., "user: User logged in ...") - 'local0:' # Indicates a syslog local facility log, marking the start of a custom system event (e.g., "local0: Custom message ...") - 'local1:' # Indicates a syslog local facility log, marking the start of a custom system event (e.g., "local1: Custom message ...") - 'level=' # Indicates a structured log key, marking the start of a key-value log entry (e.g., "level=info msg=Started") - 'msg=' # Indicates a structured log key, marking the start of a message log entry (e.g., "msg=Application started") - 'message=' # Indicates a structured log key, marking the start of a message log entry (e.g., "message=Application started") - 'event=' # Indicates a structured log key, marking the start of an event log entry (e.g., "event=Service startup") - 'thread=' # Indicates a structured log key, marking the start of a thread-specific log entry (e.g., "thread=main Processing ...") - 'Starting ' # Indicates the start of a process initiation log (e.g., "Starting server on port 8080") - 'Stopping ' # Indicates the start of a process termination log (e.g., "Stopping service ...") - 'Running ' # Indicates the start of a process status log (e.g., "Running task ...") - 'Listening ' # Indicates the start of a network service log (e.g., "Listening on port 8080 ...") - 'Connecting ' # Indicates the start of a connection attempt log (e.g., "Connecting to database ...") - 'Connected ' # Indicates the start of a successful connection log (e.g., "Connected to database ...") - 'Disconnected ' # Indicates the start of a disconnection log (e.g., "Disconnected from server ...") - 'Processing ' # Indicates the start of a task processing log (e.g., "Processing request ...") - 'Received ' # Indicates the start of a data reception log (e.g., "Received message ...") - 'Sent ' # Indicates the start of a data transmission log (e.g., "Sent response ...") - 'User ' # Indicates the start of a user action log (e.g., "User logged in ...") - 'Authentication ' # Indicates the start of an authentication log (e.g., "Authentication successful ...") - 'Authorized ' # Indicates the start of an authorization log (e.g., "Authorized user access ...") - 'Failed ' # Indicates the start of a failure log (e.g., "Failed login attempt ...") - 'kubelet:=true' # Indicates a Kubernetes kubelet log entry, marking the start of a node event (e.g., "kubelet: Starting kubelet") - 'pod:=true' # Indicates a Kubernetes pod log entry, marking the start of a pod event (e.g., "pod: Starting container") - 'container:=true' # Indicates a Kubernetes container log entry, marking the start of a container event (e.g., "container: Started") - 'namespace:=true' # Indicates a Kubernetes namespace log entry, marking the start of a namespace event (e.g., "namespace: Created") - 'Traceback ' # Indicates the start of a Python stack trace (e.g., "Traceback (most recent call last):") - 'File "' # Indicates a Python stack trace line (e.g., "File "/script.py", line 10") - 'Trace:' # Indicates a Node.js console trace (e.g., "Trace: Show me") - 'Error:' # Indicates a Node.js error log (e.g., "Error: Something went wrong") - 'Warning:' # Indicates a Node.js warning log (e.g., "Warning: Deprecated method") - 'Exception in thread ' # Indicates a Java exception header (e.g., "Exception in thread 'main'") - 'goroutine ' # Indicates a Go goroutine stack trace (e.g., "goroutine 1 [running]:") - 'panic:' # Indicates a Go panic (e.g., "panic: runtime error") - 'thread ' # Indicates a Rust thread panic (e.g., "thread 'main' panicked at") - 'stack backtrace:' # Indicates a Rust backtrace header (e.g., "stack backtrace:") - 'PHP Warning:' # Indicates a PHP warning (e.g., "PHP Warning: Undefined variable") - 'PHP Fatal error:' # Indicates a PHP fatal error (e.g., "PHP Fatal error: Out of memory") - 'in /' # Indicates a PHP/Ruby file path in stack trace (e.g., "in /path/to/file.php:10") - 'Exception:' # Indicates a C# exception (e.g., "Exception: Invalid operation") - 'terminate called' # Indicates a C++ termination (e.g., "terminate called after throwing an instance of 'std::exception'") - 'syslog:' # Indicates a Linux syslog message (e.g., "syslog: Message ...") - 'IN=' # Indicates an iptables firewall input log (e.g., "IN=eth0 OUT=") - 'OUT=' # Indicates an iptables firewall output log (e.g., "OUT=eth0 SRC=") - 'SRC=' # Indicates an iptables firewall source IP log (e.g., "SRC=192.168.1.1 DST=") - 'DST=' # Indicates an iptables firewall destination IP log (e.g., "DST=10.0.0.1 LEN=") - 'KafkaServer:' # Indicates a Kafka server log (e.g., "KafkaServer: Starting Kafka server") - 'Redis:' # Indicates a Redis server log (e.g., "Redis: Server initialized") ``` ??? tenx-eventoutputs "Event Outputs" ### Event Outputs {.hidden-heading} Activate [Event stream outputs](/run/output/event "Write TenXObject and template values to event stream outputs (e.g., stdout, files)") to write TenXObject and template values to event stream outputs (e.g., stdout, files). Below is the default configuration from: [stdout/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/output/event/stdout/config.yaml "stdout/config.yaml"){target="\_blank"}.

Edit Online

```yaml # 🔟❎ 'run' stdout output configuration # Configure stdout/err streams for writing TenXObject instance and template values. # To learn more see https://doc.log10x.com/run/output/event/stdout # Set the 10x pipeline to 'run' tenx: run # =============================== Dependencies ================================ include: run/modules/output/event/stdout # ============================= Stdout Options ================================ # Multiple stdout outputs can be defined below stdout: # ---------------------------10x Encoding Output ---------------------------- # Encode TenXObjects: https://doc.log10x.com/run/transform/#template-encoding # 'target' can be SYSTEM_OUT or SYSTEM_ERR - target: SYSTEM_OUT # 'filter' sets a JavaScript expression that TenXObjects must evaluate as truthy to write to the output. # To learn more see https://doc.log10x.com/run/output/receive/#filter-expressions filter: isObject # 'fields' defines the fields to write for each TenXObject sent to this output. # To learn more see https://doc.log10x.com/run/output/stream/#outputfields fields: - encode() # https://doc.log10x.com/api/js/#TenXObject+encode # ----------------------------- Decode Output ------------------------------- # Template-decode TenXObjects: https://doc.log10x.com/run/transform/#expand - target: SYSTEM_OUT filter: isEncoded # https://doc.log10x.com/api/js/#TenXBaseObject+isEncoded fields: - text # https://doc.log10x.com/api/js/#TenXBaseObject+text # ---------------------------- Template Output ------------------------------ # Writes TenXTemplate values: https://doc.log10x.com/run/transform/#template - target: SYSTEM_OUT # 'writeTemplates' controls whether to write new TenXObjects templates to stdout. # To learn more see https://doc.log10x.com/run/output/event/stdout/#stdoutwritetemplates writeTemplates: true # ----------------------------- Summary Output ------------------------------ # Writes aggregated TenXSummaries: https://doc.log10x.com/run/aggregate/ - target: SYSTEM_OUT filter: isSummary # https://doc.log10x.com/api/js/#TenXBaseObject+isSummary fields: - $=yield TenXEnv.get("enrichmentFields") # https://doc.log10x.com/run/initialize/#enrichmentFields - summaryVolume # https://doc.log10x.com/api/js/#TenXSummary+summaryVolume - summaryBytes # https://doc.log10x.com/api/js/#TenXSummary+summaryBytes - summaryTotals # https://doc.log10x.com/api/js/#TenXSummary+summaryTotals ``` ## :material-tune: Advanced Config Files To configure advanced options (optional) for the MCP test-drive app, [:material-cog: Edit](https://doc.log10x.com/config/app/#module-config "Learn how to edit app and module configurations") these files: ??? tenx-symbols "Symbols" ### Symbols {.hidden-heading} Below is the default configuration from: [symbol/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/symbol/config.yaml "symbol/config.yaml"){target="\_blank"}.

Edit Online

```yaml # 🔟❎ 'run' symbol file configuration # Loads symbol library files to transform events into well-defined TenXObjects. # To learn more see https://doc.log10x.com/run/symbol # Set the 10x pipeline to 'run' tenx: run # ============================ Symbol Options ================================= symbol: # 'paths' specifies the file/folder locations to scan for symbol library files. # To learn more see https://doc.log10x.com/run/symbol/#symbolpaths paths: - $=path("data/shared/symbols", false) - $=path("", false) literals: [] ``` ??? tenx-template "Template" ### Template {.hidden-heading} Below is the default configuration from: [template/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/template/config.yaml "template/config.yaml"){target="\_blank"}.

Edit Online

```yaml # 🔟❎ 'run' template file configuration # Load TenXTemplates .json files that define the structure/schema of TenXObjects. # To learn more see https://doc.log10x.com/run/template/ # Set the 10x pipeline to 'run' tenx: run # =============================== Template =================================== template: # 'files' specifies GLOB pattern for finding JSON-encoded TenXTemplates. files: - $=path("data/templates/*.json") - $=path("data/sample/output/*.json") # 'cacheSize' controls the maximum total byte size of templates held # in the in-memory cache vs. on disk. Set to 0 to disable pruning. cacheSize: $=parseBytes("10MB") # =============================== Variable =================================== var: # 'placeholder' specifies a character to use when encoding a TenXTemplate # to signify the location of a runtime variable value. placeholder: "$" # 'maxRecurIndexes' controls the maximum number of variable values to reuse. maxRecurIndexes: 10 # =============================== Timestamp ================================== timestamp: # 'prefix' specifies a prefix for a TenXTemplate's timestamp tokens. prefix: ( # 'postfix' specifies a postfix for a TenXTemplate's timestamp tokens. postfix: ) ``` ??? tenx-transform "Transform" ### Transform {.hidden-heading} Configure the [Transform](/run/transform "Transform log and trace events into well-defined TenXObjects") to transform log and trace events into well-defined TenXObjects. Below is the default configuration from: [group/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/transform/group/config.yaml "group/config.yaml"){target="\_blank"}.

Edit Online