Build the pipeline before you ship the bytes.

# Generated from the rules tested in Sift, the Expanso pipeline playground.
# The Sift live runner deploys this rule-only shape to a dedicated Edge.
name: generated-log-filter
description: "Keep signal, filter routine noise at the source."
type: pipeline
config:
  input:
    http_server:
      address: 0.0.0.0:8081
      path: /ingest

  pipeline:
    processors:
      - mapping: 'root = {"_raw": content().string()}'
      - mapping: |
          root = this
          let raw = this._raw
          let parsed = $raw.parse_json().catch(null)
          let is_json = $parsed.type() == "object"
          let is_app = $is_json && $parsed.exists("level")
          let is_json_audit = $is_json && $parsed.exists("eventVersion")

          let is_k8s = $raw.re_match("^\\d{4}-\\d{2}-\\d{2}T\\S+ (stdout|stderr) [FP] ")
          let kpay = if $is_k8s { $raw.re_find_object("^\\S+ (stdout|stderr) [FP] (?P<payload>.*)$").payload.string().catch("") } else { "" }
          let kjson = if $kpay != "" { $kpay.parse_json().catch(null) } else { null }
          let is_kjson = $kjson.type() == "object"
          let is_audit = $is_json_audit || ($is_kjson && $kjson.exists("eventVersion"))

          let is_web = $raw.re_match(".*\\\"[A-Z]+ \\S+[^\\\"]*\\\" \\d{3}.*")
          let web = if $is_web { $raw.re_find_object(".*\\\"(?P<method>[A-Z]+) (?P<path>\\S+)[^\\\"]*\\\" (?P<status>\\d{3}).*").catch({}) } else { {} }
          let is_unknown = !$is_json && !$is_k8s && !$is_web

          let level = if $is_app { $parsed.level.string().lowercase().catch("info") }
            else if $is_kjson { $kjson.level.string().lowercase().catch("info") }
            else if $is_web && $web.status.number().catch(0) >= 500 { "error" }
            else if $is_web && $web.status.number().catch(0) >= 400 { "warn" }
            else { "info" }
          let path = if $is_app { $parsed.http.path.string().catch("") }
            else if $is_kjson { $kjson.http.path.string().catch("") }
            else if $is_web { $web.path.string().catch("") }
            else { "" }
          let status = if $is_app { $parsed.http.status.number().catch($parsed.status.number().catch(0)) }
            else if $is_kjson { $kjson.http.status.number().catch($kjson.status.number().catch(0)) }
            else if $is_web { $web.status.number().catch(0) }
            else { 0 }
          let duration_ms = if $is_app { $parsed.duration_ms.number().catch($parsed.http.duration_ms.number().catch(0)) }
            else if $is_kjson { $kjson.duration_ms.number().catch($kjson.http.duration_ms.number().catch(0)) }
            else { 0 }
          let service = if $is_app { $parsed.service.string().lowercase().catch("") }
            else if $is_kjson { $kjson.service.string().lowercase().catch("") }
            else { "" }

          root.level = $level
          root.is_health = $path.re_match("^/(health|healthz|ready|livez|metrics)($|[/?])") || $raw.contains("kube-probe")
          root.is_debug = $level == "debug"
          root.is_static = $status > 0 && $status < 400 && $path.re_match("\\.(css|js|png|jpe?g|gif|ico|svg|woff2?)($|[?#])")
          root.is_auth = $service == "auth" || $path.re_match("^/(login|logout|oauth|sso)($|[/?])")
          root.is_slow = $duration_ms > 2000
          root.is_audit = $is_audit
          root.unknown = $is_unknown
          root.protected = ["error", "warn"].contains($level) || root.is_slow || root.is_auth || root.is_audit || $is_unknown

      - mapping: 'root = if this.is_health && !this.protected { deleted() } else { this }'
      - mapping: 'root = if this.is_debug && !this.protected { deleted() } else { this }'
      - mapping: 'root = if this.is_static && !this.protected { deleted() } else { this }'
      - mapping: 'root = if !this.protected && !this.unknown && (this._raw.hash("xxhash64").string().number() % 100) >= 10 { deleted() } else { this }'
      - mapping: 'root = this._raw'

  output:
    sync_response: {}