Glossary

() — Rhai's "nothing", like null: a missing field reads as (), and assigning () removes a field. Missing fields

Alias — a named set of options stored in a config file and used with -a NAME. Configuration

Auto-detection — choosing the input format by sampling the input; the default when no -f is given. Get Logs into Shape

Cascade — a list of formats tried in order on each line (-f json,line); each event records the winner in _format. Get Logs into Shape

Context lines — events shown before and after each match (-A, -B, -C). Filter

Core fields — timestamp, level, and message; -c shows only these.

Diagnostics — what Kelora reports about a run on stderr: errors (⚠️), warnings (🔸), hints (💡), and, with -v, status (🔹). What Kelora prints

Drain — the algorithm behind --drain, which groups messages into templates. Summarize

Event — one log record after parsing: a map of fields. Usually one line; with multiline grouping, several. In scripts it is e.

Field — a named value in an event, such as level or status. Values can be strings, numbers, booleans, maps, or arrays.

Late event — with time spans, an event whose timestamp falls in a span that already closed; it passes through but isn't counted in that span.

Level — an event's severity (ERROR, WARN, …), read from a field such as level or severity. Filtered with -l and -L.

meta — information about the current event that isn't one of its fields: meta.line, meta.line_num, meta.filename, meta.parsed_ts. Script variables

Metrics — values collected by track_*() functions and by --freq, --describe, --card; printed with -m, readable as metrics in --end. Summarize

Multiline — joining several physical lines into one event before parsing (-M). Multiline reference

Naive timestamp — a timestamp without a zone offset, read in --input-tz (or TZ, else UTC). Time zones

Parallel mode — processing batches of events on all CPU cores (--parallel). Big Files, Many Files

Resilient mode — the default: lines that fail to parse and scripts that fail on an event are reported and skipped, and the run continues. How It Works

Rhai — the scripting language used in --filter, --exec, and the other script options. Transform with Scripts

Span — a group of consecutive events: a time window, N events, a run of the same field value, or a burst between pauses. Group into Spans

Stage — one --filter, --exec, -l, -L, or --assert step. Stages run in command-line order. How It Works

State — the state map, which keeps values from one event to the next. Cross-Event Logic

Stats — the processing summary printed by -s: counts, errors, time span, fields seen.

Strict mode — --strict: the first parse or script error stops the run with exit code 1.

Template — a message pattern with its variable parts replaced by placeholders, as found by --drain: Connection timeout after <duration>.

Time range — the period selected with --since and --until, applied before any other filter. Work with Time

Window — with --window N, the current event and the N before it, available to scripts as window. Cross-Event Logic