--- title: "Origin Selector" description: "select the source code/binary executable origin of TenXTemplate symbol\ \ values" source: "https://github.com/log-10x/modules/tree/main/pipelines/run/units/transform/symbol/unit.yaml" icon: "material/origin" --- Identify the source code/binary executable origin of [symbol](https://doc.log10x.com/run/transform/structure/#symbols) values within [TenXTemplate](https://doc.log10x.com/engine/design/#optimization-model) hidden classes. Identifying where each symbol value originated from within TenXTemplates enables [reflective programming](https://en.wikipedia.org/wiki/Reflective_programming){target="\_blank"} wherein [TenXObjects](https://doc.log10x.com/api/js/#TenXObject "Provide structured, reflective access to log/trace events read from input(s).") can inspect their structure and member types and source code/executable file origin. Each symbol lists its file of origin (e.g., foo.js, sudo, acme.dll) and the [context](#contexts) in which it appears in it (e.g., class/func/enum name, string format..). Source code/executable origin information is accessible at run time via the [symbol](https://doc.log10x.com/api/js/#TenXObject+symbol), [symbolSequence](https://doc.log10x.com/api/js/#TenXObject+symbolSequence), and [symbolOrigin](https://doc.log10x.com/api/js/#TenXObject+symbolOrigin) functions. ```js this.class = this.symbol("class"); this.sequence = this.symbolSequence("log,exec"); this.origin = this.symbolOrigin("log,exec"); ``` For the following Apache Spark [log event](https://github.com/logpai/loghub/blob/20168f0fc076be8a75d22c01896076090d4a3c6e/Spark/Spark_2k.log#L14){target="\_blank"}: > 17/06/09 20:10:42 INFO executor.CoarseGrainedExecutorBackend: Connecting to driver: spark://CoarseGrainedScheduler@10.10.34.11:48069 |Field|Value| |---|---| |class|CoarseGrainedExecutorBackend| |sequence|Connecting to driver| |origin|[CoarseGrainedExecutorBackend.scala](https://github.com/apache/spark/blob/master/core/src/main/scala/org/apache/spark/executor/CoarseGrainedExecutorBackend.scala){target="\_blank"}| For the following Unix [log event](https://github.com/logpai/loghub/blob/20168f0fc076be8a75d22c01896076090d4a3c6e/Linux/Linux_2k.log#L3){target="\_blank"}: > Jun 14 15:16:02 combo sshd(pam\_unix)\[19937\]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=218.188.2.4 |Field|Value| |---|---| |class|""| |sequence|authentication failure| |origin|[sshd](https://linux.die.net/man/8/sshd){target="\_blank"}| ## Contexts Compile [scanners](https://doc.log10x.com/compile/scan/ "Capture symbol values from source code/binary files and link to an output symbol library") assigns each extracted [symbol](https://doc.log10x.com/run/transform/structure/#symbols) value within a target source code/binary file a _context_ which describes its meaning and position within the file. Supported contexts include: ### **`package`** Source code package/namespace name. For example: ```java package com.acme.client.core; public class AcmeLogic { ... } ``` ```c# namespace MyCompany.Proj1 { class MyClass1 { ... } } ``` ### **`class`** Source code class/interface definition. For example: ```python class AcmeClient: ... ``` ```java public interface AcmeServer {...} ``` The scanner will capture _AcmeServer_, _AcmeClient_ as **class** symbols. The scanner will capture _com.acme.client.core_, _MyCompany.Proj1_ as **package** symbols. ### **`method`** Source code method/function name. For example: ```js function hostError(host) {...} ``` ```cpp void Person::get_name() { ``` The scanner will capture _hostError_, _get\_name_ as **method** symbols ### **`enum`** Source code enum literal value. For example: ```py from enum import Enum class STATUS(Enum): OK = 1 FAIL = 2 RETRY = 3 ``` The scanner will capture: - _OK_, _FAIL_, _RETRY_ as **enum** symbols - _STATUS_ as a **class** symbol ### **`log`** Source code constant arg within a [logging](https://doc.log10x.com/compile/scan/logMethods/) method. For example: ```js function hostError(host) { //The "error connecting" symbol passes as an indirect arg to the logger var msg = fmtError("error connecting", host); console.error(msg); } ``` The scanner will capture _error connecting_ as a **log** symbol. ### **`const`** Source code constant value assigned to a variable, parameter or code annotation. For example: ```java @JsonElement(key = "price") public String price; ``` ```js report("state: " + state); ``` ```js this.key = "key"; ``` The scanner will capture _price_, _state_, _key_ as a **const** symbol. ### **`exec`** Symbol captured from a custom program or OS command via the [executable](https://doc.log10x.com/compile/scanner/executable "Launch a target process from which to read symbol values via its stdout") symbol scanner (e.g., [strings](https://linux.die.net/man/1/strings){target="\_blank"}). For example: ```console strings -a /usr/bin/sudo ``` The scanner will capture _Authentication failure message %s_ as an **exec** symbol. ### **`text`** Config field name/value captured from file (e.g., .xml, .json) via the [text](https://doc.log10x.com/compile/scanner/text/ "Scan text/binary files for symbol values using the Jackson library") symbol scanner. For example: ```yaml spring: name: test environment: testing ``` The scanner will capture the field names _spring_, _name_, and _environment_ as **text** symbols. The _test_ and _testing_ field values are only captured as text if the [textScanFieldValues](https://doc.log10x.com/compile/scanner/text/#textscanfieldvalues "controls whether to capture Jackson parser field values") is set to true. ## :material-wrench-outline: Config Files To configure the Origin selector unit, [:material-cog: Edit](https://doc.log10x.com/config/app/#module-config "Learn how to edit app and module configurations") these files. Below is the default configuration from: [symbol/config.yaml](https://github.dev/log-10x/config/blob/main/pipelines/run/transform/symbol/config.yaml "symbol/config.yaml"){target="\_blank"}.
Edit Online
Edit config.yaml Locally
```yaml # 🔟❎ 'run' symbol origin configuration # Identify the origin of symbol values within TenXTemplates. # To learn more see https://doc.log10x.com/run/transform/symbol/ # Set the 10x pipeline to 'run' tenx: run # =============================== Origin Options ============================== symbol: # 'maxOrigins' controls the number of source/binary origins to list # per symbol token sequence. As a series of tokens within # a target TenXTemplate (e.g., 'ERROR', 'could not connect to "{}') may appear # in multiple source/binary files within the pipeline's loaded library. # The sorting algorithm configured below is used to select the 'maxSymbolOrigins' # topmost entries to list. maxOrigins: 64 # 'sequenceReserved' defines a list of terms to ignore when searching # for the symbol tokens that constitute an TenXTemplate's 'message' portion. # For example, for an event whose text contains: 'connect success = true', # the value 'true' will not be considered a part of the event's message, # as the 'true' value is mostly likely the result of a variable boolean state. # For more information, see: https://doc.log10x.com/api/js/#TenXObject+symbolSequence sequenceReserved: # literals - "null" - "nil" - "true" - "false" # stopwords (articles, conjunctions, prepositions) - "a" - "an" - "the" - "to" - "of" - "in" - "on" - "at" - "by" - "for" - "from" - "with" - "and" - "or" - "as" - "is" # generic log words - "log" - "logger" - "logs" - "http" - "https" # severity levels, uppercase - TRACE - DEBUG - INFO - NOTICE - WARN - WARNING - ERROR - ERR - CRITICAL - CRIT - ALERT - EMERGENCY - EMERG - FATAL - PANIC # severity levels, lowercase (engine matching is case-sensitive). # Note. The token "error" is intentionally NOT reserved here. # Verification against 3254 demo events (2026-05-20) found 1280 # signal hits where the "error" key carries the actual message # body the pattern groups; reserving it would collapse distinct # error patterns into one. # Note. The token "emergency" is also intentionally NOT reserved #, sample showed only prose hits, no envelope use observed. - "trace" - "debug" - "info" - "notice" - "warn" - "warning" - "err" - "critical" - "crit" - "alert" - "fatal" - "panic" # severity-equivalent envelope keys - "level" - "levelname" - "severity" # envelope time keys - "time" - "timestamp" - "ts" - "msg" - "message" # OpenTelemetry / collector envelope (these tokens leak from the # otelcol's Go-package logging into pattern names) - "otel" - "otelcol" - "opentelemetry" - "collector" - "contrib" - "processor" - "processors" - "receiver" - "receivers" - "exporter" - "exporters" - "pipeline" - "pipelines" # structured / envelope keys (singular + plural, engine matcher # is exact, no stem; both forms appear in real otel logs). # Note: "trace" is already reserved above under lowercase severity. - "service" - "services" - "instance" - "instances" - "component" - "components" - "signal" - "signals" - "resource" - "resources" - "scope" - "scopes" - "attribute" - "attributes" - "traces" - "span" - "spans" - "flag" - "flags" - "context" - "contexts" - "baggage" # K8s audit / Kubernetes API envelope (verified zero signal in # the 2026-05-20 sample, every occurrence was a JSON metadata # key or audit field) - "metadata" - "namespace" - "verb" - "uid" - "identity" - "protocol" - "priority" - "encoding" - "headers" - "duration" # HTTP / request envelope (verified safe, appear only as # klog field markers or JSON keys, not as message content) - "path" - "status" # generic identity keys (very common envelope tokens in JSON logs) - "id" - "name" - "kind" - "version" - "type" # source-location envelope (Go / Java / Python loggers leak these) - "caller" - "func" - "function" - "file" - "line" - "module" - "package" - "class" - "method" - "stack" - "stacktrace" # process / runtime context. # Note. The token "host" is intentionally NOT reserved, 1018 of # 1024 occurrences in the verification corpus were the content # phrase "no such host" inside DNS-failure messages; reserving # it would collapse every "no such host" pattern into one. # Note. The token "app" is intentionally NOT reserved, 42 of 44 # occurrences were the Flask logger-name discriminator in # "INFO in app:" lines; reserving it would collapse Python-app # logger structure. - "pid" - "tid" - "process" - "thread" - "hostname" - "application" # package-qualifier prefixes (Go / Java loggers embed these in # source-path tokens like `com.foo.bar.MyLogger`) - "com" - "org" - "io" - "net" # tokenizer artifacts - "t" # ----------------------------- Debug Options ------------------------------- debug: # 'symbol' debugging allows for verbose printing of the selection process # for symbol tokens from the pipeline's 10x symbol files used to produce the # results of 10x reflection functions. # For more information, see: https://doc.log10x.com/api/js/#TenXObject+symbol # 'loggerName' controls the name of the log4j logger used by origins and symbols below loggerName: "symbolDebugger" # 'origins' outputs information about the origin selection process for an TenXTemplate symbol. # For example, setting 'units' to 'foo.js' will output information about if/how it # was selected as the origin of TenXTemplate symbols. # In other words, if a symbol (e.g., 'MyClass') has 'foo.java' as the source file # from which it originated, adding 'foo.js' to 'units' will emit information # about the selection process. # Specifying '*' will emit information for all source /binary files that have # been selected as the origin of any TenXTemplate objects within the pipeline. origins: [ # '*' ] # 'symbols' logs the origin selection process for symbol tokens within an TenXTemplate. # For example, set 'symbols' to 'Could not connect to' to log how the 10x JavaScript 'symbolSequence' # determines the origin source code/binary file within the pipeline's symbol library. # Specifying '*' will emit information for all source code /binary files that have # been selected as the origin of any TenXTemplate objects within the pipeline. symbols: [ # '*' ] ``` ## :material-menu: Options Specify the options below to [configure](/config "configure") the Origin selector: |Name|Description|Category| |---|---|---| |[symbolSequenceReserved](#symbolsequencereserved "list of terms to ignore when scanning symbol tokens")|List of terms to ignore when scanning symbol tokens|Symbol| |[symbolMaxOrigins](#symbolmaxorigins "max number of source/binary origins to list per symbol")|Max number of source/binary origins to list per symbol|Symbol| |[symbolDebugOrigins](#symboldebugorigins "list of source scanned file names for which to log information")|List of source scanned file names for which to log information|Debug| |[symbolDebugSymbols](#symboldebugsymbols "list of TenXTemplate symbol values for which to log information")|List of TenXTemplate symbol values for which to log information|Debug| |[symbolDebugLoggerName](#symboldebugloggername "debug logger name")|Debug logger name|Debug| ### Symbol #### :material-menu-right-outline:**`symbolSequenceReserved`** List of terms to ignore when scanning symbol tokens. |Type|Default|Category| |---|---|---| |List|\[null, nil, true, false\]|Symbol| Defines a list of terms that to ignore when searching for the symbol tokens constituting an TenXTemplate's 'message' portion (i.e., the [symbol](https://doc.log10x.com/run/transform/structure/#symbols) tokens of the origin ranked highest by coverage, meaning the count of distinct library-known tokens it explains; span length is the last tiebreak). For example, for an TenXObject whose text contains: 'connect success = true', the value 'true' will not be considered a part of the instance's message, as it is mostly likely the result of a variable boolean state. To learn more see [symbolSequence](https://doc.log10x.com/api/js/#TenXObject+symbolSequence). #### :material-menu-right-outline:**`symbolMaxOrigins`** Max number of source/binary origins to list per symbol. |Type|Default|Category| |---|---|---| |Number|64|Symbol| Controls the number of source code/binary origins to list per symbol token sequence. As a series of tokens within a given template (e.g., 'ERROR', 'could not connect to "{}') may appear in multiple source/binary files within the pipeline's symbol files, the sorting algorithm selects [maxSymbolOrigins](https://doc.log10x.com/run/transform/symbol/#symbolmaxorigins "max number of source/binary origins to list per symbol") for comparison. ### Debug #### :material-menu-right-outline:**`symbolDebugOrigins`** List of source scanned file names for which to log information. |Type|Default|Category| |---|---|---| |List|\[\]|Debug| Specifies a list of input file names within the loaded symbol library (e.g., 'my.scala', 'foo.java') for which to log information on if/how they participate in selecting the origin of a target TenXTemplate symbol sequence. This option helps debug how the [symbolSequence](https://doc.log10x.com/api/js/#TenXObject+symbolSequence) function selects origin values for a target TenXTemplate symbol sequence. Specify '\*' for all input files. #### :material-menu-right-outline:**`symbolDebugSymbols`** List of TenXTemplate symbol values for which to log information. |Type|Default|Category| |---|---|---| |List|\[\]|Debug| List of symbol values such as class and method names(e.g., 'MyClass', 'foo') for which to log information on how their origin information is selected. This option helps debug how the [symbolSequence](https://doc.log10x.com/api/js/#TenXObject+symbolSequence) function selects origin values for a target TenXTemplate symbol sequence. Specify '\*' for all symbols. #### :material-menu-right-outline:**`symbolDebugLoggerName`** Debug logger name. |Type|Default|Category| |---|---|---| |String|[consoleOut](https://github.com/log-10x/config/blob/main/log4j2.yaml#L66 "consoleOut"){target="\_blank"}|Debug| Controls the name of the log4j logger used by [debugOrigins](https://doc.log10x.com/run/transform/symbol/#symboldebugorigins "list of source scanned file names for which to log information") and [debugSymbols](https://doc.log10x.com/run/transform/symbol/#symboldebugsymbols "list of TenXTemplate symbol values for which to log information").
:material-github: This unit is defined in [symbol/unit.yaml](https://github.com/log-10x/modules/tree/main/pipelines/run/units/transform/symbol/unit.yaml "symbol/unit.yaml"){target="\_blank"}.