Logarithm::AbstractLogSource

Abstract base class for log data sources.

Log sources are responsible for ingesting log data from various sources (files, systemd journal, network streams, etc.) and feeding them into the anomaly detection pipeline via channels.

Interface

All log sources must implement three methods:

• start(channel): Begin reading logs and send them to the channel
• stop: Stop reading and clean up resources
• descriptions: Return human-readable source descriptions

Threading Model

Log sources typically run in background fibers/spawns to avoid blocking the main pipeline. They should handle graceful shutdown via the stop method.

Example Implementation

class MyLogSource < AbstractLogSource
  def start(channel : Channel(String))
    @running = true
    spawn do
      while @running
        log_line = read_next_log
        channel.send(log_line)
      end
      channel.close
    end
  end

  def stop
    @running = false
  end

  def descriptions : Array(String)
    ["my custom log source"]
  end
end

Built-in Implementations

• JournaldLogSource: Reads from systemd journal
• VarlogLogSource: Reads from syslog files
• MultiLogSource: Combines multiple sources