logmole on krtffl.dev

a query language in ~1000 lines: lexer, parser, evaluator

Mon, 25 May 2026 00:00:00 +0000

here’s a question that sounds trivial and isn’t: show me every 5xx response that also mentions a timeout.

in grep that’s a fragile little dance — grep -E 'status[=:] ?5[0-9]{2}' piped into another grep timeout, and now you’re matching 500 inside a request id, timeout inside a url, and you’ve quietly stopped trusting the output. what you wanted was this:

text

status >= 500 AND message contains "timeout"

and have the machine read >= as numeric greater-or-equal, AND as boolean conjunction, and "timeout" as a substring on one named field. that’s not grep. that’s a little language, and little languages need a lexer, a parser, and something to run them.

welford's algorithm and why i never store the samples

Mon, 13 Apr 2026 00:00:00 +0000

you want to know if the error rate just spiked. that’s a z-score: how many standard deviations is right now away from what normal looked like. simple formula, (x - mean) / stddev, you learned it before you could legally drink.

except a standard deviation needs a mean, and a mean needs all the numbers, and the numbers are a log file the size of a small moon. so where, exactly, are you keeping them?

implementing the drain algorithm in rust

Mon, 23 Mar 2026 00:00:00 +0000

picture the scene: something is on fire in production, you ssh into the box, tail a log file, and you’re greeted by forty thousand lines that all look almost the same but not quite. your eyes glaze over. you grep error, then grep -v the noise, then pipe the whole thing into sort | uniq -c and pray.

there’s a better way, and it’s older than you’d think.