Area 52

Experimental structured log collector with logs visualization inspired by Seq and ELK Stack.

This project uses RavenDb or MongoDb as a log store and search engine.

Everyone wants to know what's in Area 51. But no one asks about Area 52.

Features

• Log input endpoint compatibile wirh Seq (CLEF logs format)
• Custom query language (inspired by Rockstar language and SQL), supports:
  • fulltext search,
  • search by match property, comparison,
  • search by time,
  • logical operator,
  • and more...
• Area52.Ufo is service for abducing logs from text files and from Syslog (UDP by RFC 5424) into Area52

Moore screenshots doc/Readme.md.

Technology

• Dotnet 6.0
• Blazor server
• Piglet as query parser
• RavenDb as primary storage and indexing engine
• MongoDb as alternative storage and indexing engine
• Bootstrap 5 and Font Awesome 4

Build

Area52 use Nuke as build automation.

For build run in powershell:

&dotnet tool restore
.\build.ps1 --Configuration Release

Future work

• More efective read CLEF log from request
• Autehntification
  • Predefined queries
  • Distributed data protection provider
  • API keys for log input with management
• Graph and alerts as subsriptions
  • Time series graphs
  • Alerts
• Log archiving using background workers
• Implements healthchecks
• Try implement using MongoDb
• Dashboard
• Local query history - in URL

Getting logs into Area 52

It is possible to use libraries for SEQ. Serilog example:

dotnet package add Serilog.Sinks.Seq

using Serilog;

Log.Logger = new LoggerConfiguration()
   .MinimumLevel.Verbose()
   .WriteTo.Seq("http://localhost:7142")
   .CreateLogger();

NLog example:

dotnet package add NLog.Targets.Seq

Add to NLog.config:

<extensions>
    <add assembly="NLog.Targets.Seq"/>
</extensions>

<targets>
   <target name="seq" xsi:type="BufferingWrapper" bufferSize="1000" flushTimeout="2000">
     <target xsi:type="Seq" serverUrl="http://localhost:7142" apiKey="" />
   </target>
</targets>
<rules>
  <logger name="*" minlevel="Info" writeTo="seq" />
</rules>

For log into file see doc/FileLogging.md.

Copyright

Copyright (c) 2024 harrison314