Validate

Internal runtime invoked by the MCP Server's log10x_validate tool. You rarely invoke @apps/mcp directly. This page exists for debugging — reproducing what log10x_validate ran, when its output surprised you.

What it does

When an agent calls log10x_validate, the server spawns tenx @apps/mcp as a subprocess. The subprocess reads log lines on stdin and writes TenXObjects + TenXTemplates as JSON lines on stdout. No filesystem, no network. The server parses the output and returns it to the agent.

Reproduce a `log10x_validate` call locally

echo "<your log line>" | tenx @apps/mcp

Stack your candidate config after the base app to validate it:

echo "<your log line>" | tenx @apps/mcp @/path/to/your-config.yaml

The stdout is what log10x_validate returns to the agent. Diff against the agent's reported output to find where they diverge.

Why narrower than `@apps/dev`

@apps/mcp omits httpCode and lookup enrichment because their embedded scripts reference engine builtins that move between releases. Keeping the runtime pinned to stable primitives means log10x_validate behaves consistently across engine upgrades.

If you need richer enrichment for local exploration, use Dev instead.

Config Files

To configure the MCP test-drive app, Edit these files:

Main Config

The main config file loads the MCP test-drive app's required modules.

Uncomment selected modules at: mcp/config.yaml.

Edit Online

#
# 🔟❎ MCP-driven test-drive app
#
# A stdin/stdout-only variant of @apps/dev. Every I/O channel that @apps/dev
# routes through the filesystem (input file, output dirs, dev browser) is
# replaced here by the process's stdin/stdout, so an MCP tool can pipe log
# lines in, receive TenXObject + TenXTemplate output, and never touch disk.
#
# Intended single invocation:
#
#     echo "<log lines>" | tenx @apps/mcp [@<user-provided-code-file>]
#
# The caller can stack an additional @<file> that adds modules, constructors,
# or filters to be validated alongside this app — that file is mounted by
# the CLI alongside this config.
#
# To learn more see https://doc.log10x.com/apps/dev (the @apps/dev sibling).

tenx: run

runtimeName: $=TenXEnv.get("TENX_RUNTIME_NAME", "myMcp")

# ============================ Load App Modules ===============================

include:

  # ------------------------------ App settings ---------------------------------

  # Load general app settings from modules/apps/mcp.
  - mcp

  # ------------------------------ Input: stdin -------------------------------

  # Open stdin as the pipeline's only input. stdinEnabled defaults to true
  # in the module, but set explicitly below so a caller passing `-in false`
  # can suppress it without having to override two variables.
  - run/input/stdin                # https://doc.log10x.com/run/input/stdin

  # --------------------------- Enrich TenXObjects ----------------------------

  # Minimal enrichment chain: level + group + message. Enough for template
  # extraction and timestamp classification, which is what most validation
  # tests need. Deliberately omits `httpCode` and `lookup` because their
  # embedded scripts reference engine builtins (e.g. findTokenNear) that
  # vary between engine versions and would force the caller onto a
  # specific CLI vintage.
  - run/initialize/inputField      # https://doc.log10x.com/run/initialize/#inputfield
  - run/initialize/level           # https://doc.log10x.com/run/initialize/level
  - run/initialize/group           # https://doc.log10x.com/run/initialize/group
  - run/initialize/message         # https://doc.log10x.com/run/initialize/message

  # `custom` auto-discovers user-supplied object constructors (e.g., a
  # GeoRefCityObject-style `TenXObject`-extender, or a debug logger) from
  # whatever .js files the caller mounts under an included directory.
  - run/initialize/custom          # https://doc.log10x.com/run/transform/script/object

  # ------------------------------ Output: stdout -----------------------------

  # Single stdout encoder; emits encoded TenXObjects as JSON lines so the
  # MCP wrapper can parse without ambiguity.
  - run/output/event/stdout        # https://doc.log10x.com/run/output/event/stdout

# ============================== Runtime args ================================

# Force stdin + stdout on by default. Both can still be toggled from the
# command line (`-stdinEnabled false`, `-stdoutWriteObjects false`).
stdinEnabled: true
stdoutTarget: SYSTEM_OUT
stdoutWriteObjects: true

# Do NOT set `quiet: true` here (unlike @apps/streamer/*). The whole
# point of @apps/mcp is surfacing TenXConsole.log / TenXLog.info output so
# validation can inspect runtime-side assertions.

Inputs

Activate Event inputs to read events from local/remote sources to transform into TenXObjects.

Below is the default configuration from: stdin/config.yaml.

Edit Online

# 🔟❎ 'run' Stdin input configuration

# Configure a stdin event input. To learn more see https://doc.log10x.com/run/input/stdin/

# Set the 10x pipeline to 'run'
tenx: run

# =============================== Dependencies ================================

include: run/modules/input/stdin

# =============================== Stdin Options ===============================

# NOTE: a pipeline should configure no more than a single stdin input

stdin:

  # ---------------------------- Parsing Options ----------------------------

    # 'extractors' defines a list of JSON/regex extractor names
    #  used to capture and redact event values from 'path' to transform 
    #  into TenXObjects. To learn more see: https://doc.log10x.com/run/input/extract         
  extractors: [
  ]

  # 'sourcePattern' defines a regex pattern that captures a 'source' value
  #  for each event read from the file and transformed into an TenXObject.
  #  This value will be used to sequence all events sharing this 'source' value correctly 
  #  so they are not mixed with events originating from different locations.    
  sourcePattern: null

Initializers

Activate an Object initializer to enrich TenXObjects with additional context.

Message Level Group

message

Configure the Symbol Message Calculator to enrich TenXObjects with logical message symbol sequence and origin values.

Below is the default configuration from: message/config.yaml.

Edit Online

# 🔟❎ 'run' symbol lookup configuration

# Configure a symbol origin lookup to enrich TenXObjects
# To learn more see https://doc.log10x.com/run/initialize/message/

# Set the 10x pipeline to 'run'
tenx: run

# =============================== Dependencies ================================

include: run/modules/initialize/message

# ============================== Symbol Options ===============================

symbol:

  # 'types' specifies the types of symbols to search for; if the first type does not yield a result, the next one is tried etc.
  #  Supported values (case insensitive), PACKAGE, CLASS, METHOD, LOG, ENUM, CONST, TEXT, EXEC, ANY
  #  To learn more see https://doc.log10x.com/run/transform/symbol/#contexts
  contexts: log,exec

  # 'messageField' specifies the field name to assign the source/binary origin file name to target TenXObjects
  messageField: message_pattern

  # 'maxLen' specifies the max char len of the output messageField
  maxLen: 70

level

Configure the Level Classifier to classify TenXObjects with a severity level.

Below is the default configuration from: level/config.yaml.

Edit Online

# 🔟❎ 'run' level classifier configuration

# Configuration level classifier to enrich TenXObjects
# To learn more see https://doc.log10x.com/run/initialize/level/

# Set the 10x pipeline to 'run'
tenx: run

# =============================== Dependencies ================================

include: run/modules/initialize/level

# =============================== Level Options ===============================

level:

  # 'field' specify the field name to assign with the inferred severity level
  field: severity_level

  # 'terms' specify severity level classification, start-of-line matching
  #  Used to identify the severity level (TRACE, DEBUG, INFO, WARN, ERROR, CRITICAL) of a log line, typically marking
  #  the start of a log event (head). Sorted by likelihood and uniqueness. Used in a Trie for O(m) matching.
  terms:
    - 'trace=TRACE'          # Common in JavaScript (Winston) or custom logs; e.g., "trace Variable x = 5"
    - 'Trace=TRACE'          # Mixed case; e.g., "Trace Variable x = 5"
    - 'TRACE=TRACE'          # Uppercase, less common; e.g., "TRACE Message"
    - 'debug=DEBUG'          # Common in JavaScript (Winston) or custom logs; e.g., "debug Entering method foo"
    - 'Debug=DEBUG'          # Mixed case; e.g., "Debug Entering method foo"
    - 'DEBUG=DEBUG'          # Uppercase; e.g., "DEBUG Message"
    - 'DBG=DEBUG'            # Abbreviation, less common; e.g., "DBG Entering method foo"
    - 'info=INFO'            # Common in JavaScript (Winston) or custom logs; e.g., "info Application started"
    - 'Info=INFO'            # Mixed case; e.g., "Info Application started"
    - 'INFO=INFO'            # Uppercase; e.g., "INFO Message"
    - 'notice=INFO'          # Common in custom logs or lowercase syslog; e.g., "notice Configuration updated"
    - 'Notice=INFO'          # Mixed case; e.g., "Notice Configuration updated"
    - 'NOTICE=INFO'          # Uppercase, syslog; e.g., "NOTICE Message"
    - 'warn=WARN'            # Common in JavaScript (Winston) or custom logs; e.g., "warn Low disk space"
    - 'Warn=WARN'            # Mixed case; e.g., "Warn Low disk space"
    - 'WARN=WARN'            # Uppercase; e.g., "WARN Message"
    - 'warning=WARN'         # Common in custom logs or verbose frameworks; e.g., "warning Low disk space"
    - 'Warning=WARN'         # Mixed case; e.g., "Warning Low disk space"
    - 'WARNING=WARN'         # Uppercase; e.g., "WARNING Message"
    - 'error=ERROR'          # Common in JavaScript (Winston) or custom logs; e.g., "error Failed to connect"
    - 'Error=ERROR'          # Mixed case; e.g., "Error Failed to connect"
    - 'ERROR=ERROR'          # Uppercase; e.g., "ERROR Message"
    - 'err=ERROR'            # Lowercase abbreviation; e.g., "err Failed to connect"
    - 'ERR=ERROR'            # Uppercase abbreviation; e.g., "ERR Message"
    - 'TypeError=ERROR'      # JavaScript, stack trace; e.g., "TypeError: undefined is not a function"
    - 'ReferenceError=ERROR' # JavaScript, stack trace; e.g., "ReferenceError: x is not defined"
    - 'ValueError=ERROR'     # Python, stack trace; e.g., "ValueError: invalid literal"
    - 'PHP_Warning=ERROR'    # PHP, warning message; e.g., "PHP Warning: Undefined variable"
    - 'fatal=CRITICAL'       # Common in custom logs; e.g., "fatal System crash"
    - 'Fatal=CRITICAL'       # Mixed case; e.g., "Fatal System crash"
    - 'FATAL=CRITICAL'       # Uppercase; e.g., "FATAL Message"
    - 'critical=CRITICAL'    # Common in custom logs; e.g., "critical System crash"
    - 'Critical=CRITICAL'    # Mixed case; e.g., "Critical System crash"
    - 'CRITICAL=CRITICAL'    # Uppercase; e.g., "CRITICAL Message"
    - 'crit=CRITICAL'        # Lowercase abbreviation, syslog; e.g., "crit System crash"
    - 'CRIT=CRITICAL'        # Uppercase abbreviation, syslog; e.g., "CRIT Message"
    - 'alert=CRITICAL'       # Common in custom logs or syslog; e.g., "alert High CPU usage"
    - 'Alert=CRITICAL'       # Mixed case; e.g., "Alert High CPU usage"
    - 'ALERT=CRITICAL'       # Uppercase, syslog; e.g., "ALERT Message"
    - 'emerg=CRITICAL'       # Common in custom logs or lowercase syslog; e.g., "emerg System unusable"
    - 'Emerg=CRITICAL'       # Mixed case; e.g., "Emerg System unusable"
    - 'EMERG=CRITICAL'       # Uppercase, syslog; e.g., "EMERG Message"
    - 'panic=CRITICAL'       # Go panic, first line; e.g., "panic: runtime error: index out of range"
    - 'fatal_error=CRITICAL' # Go fatal error, first line; e.g., "fatal error: all goroutines are asleep"
    - 'thread_main_panicked_at=CRITICAL' # Rust panic, first line; e.g., "thread 'main' panicked at 'explicit panic'"
    - 'Segmentation_fault=CRITICAL' # C/C++ memory violation, first line; e.g., "Segmentation fault (core dumped)"
    - 'Aborted=CRITICAL'     # C/C++ termination, first line; e.g., "Aborted (core dumped)"
    - 'Assertion_failed=CRITICAL' # C/C++ assertion failure, first line; e.g., "Assertion failed: x > 0"
    - 'PHP_Fatal_error=CRITICAL' # PHP fatal error, first line; e.g., "PHP Fatal error: Out of memory"
    - 'Traceback_most_recent_call_last=CRITICAL' # Python stack trace, first line; e.g., "Traceback (most recent call last)"
    - 'Stack_trace=CRITICAL' # Generic stack trace, first line; e.g., "Stack trace"
    - 'Error=CRITICAL'       # JavaScript, stack trace; e.g., "Error: Something went wrong"
    - 'Fatal_error=CRITICAL' # PHP, stack trace; e.g., "Fatal error: Uncaught Exception"
    - 'Unhandled_exception=CRITICAL' # C#/Dart, stack trace; e.g., "Unhandled exception: System.NullReferenceException"
    - 'Exception_in_thread=CRITICAL' # Java, stack trace; e.g., "Exception in thread 'main' java.lang.RuntimeException"
    - 'goroutine=CRITICAL'   # Go, stack trace; e.g., "goroutine 1 [running]:"
    - 'failed=ERROR'         # ERROR-level entries in application, system, or web server logs

  # 'timestampPatterns' patterns for LogEvent head classification, start-of-line matching
  #  Used to identify timestamp formats in log lines and infer their implied severity level based on the first character.
  #  Formats are typical of Kubernetes kube-apiserver logs with varying microsecond precision. The first character
  #  ('I', 'W', 'E', 'F') determines the severity: I=INFO, W=WARN, E=ERROR, F=CRITICAL. Sorted by precision.
  timestampPatterns:
    - "'I'MMdd HH:mm:ss.S=INFO"          # Used in Kubernetes kube-apiserver logs with INFO prefix, 1-digit microsecond precision
    - "'I'MMdd HH:mm:ss.SS=INFO"         # Used in Kubernetes kube-apiserver logs with INFO prefix, 2-digit microsecond precision
    - "'I'MMdd HH:mm:ss.SSS=INFO"        # Used in Kubernetes kube-apiserver logs with INFO prefix, 3-digit microsecond precision
    - "'I'MMdd HH:mm:ss.SSSS=INFO"       # Used in Kubernetes kube-apiserver logs with INFO prefix, 4-digit microsecond precision
    - "'I'MMdd HH:mm:ss.SSSSS=INFO"      # Used in Kubernetes kube-apiserver logs with INFO prefix, 5-digit microsecond precision
    - "'I'MMdd HH:mm:ss.SSSSSS=INFO"     # Used in Kubernetes kube-apiserver logs with INFO prefix, 6-digit microsecond precision
    - "'W'MMdd HH:mm:ss.S=WARN"          # Used in Kubernetes kube-apiserver logs with WARNING prefix, 1-digit microsecond precision
    - "'W'MMdd HH:mm:ss.SS=WARN"         # Used in Kubernetes kube-apiserver logs with WARNING prefix, 2-digit microsecond precision
    - "'W'MMdd HH:mm:ss.SSS=WARN"        # Used in Kubernetes kube-apiserver logs with WARNING prefix, 3-digit microsecond precision
    - "'W'MMdd HH:mm:ss.SSSS=WARN"       # Used in Kubernetes kube-apiserver logs with WARNING prefix, 4-digit microsecond precision
    - "'W'MMdd HH:mm:ss.SSSSS=WARN"      # Used in Kubernetes kube-apiserver logs with WARNING prefix, 5-digit microsecond precision
    - "'W'MMdd HH:mm:ss.SSSSSS=WARN"     # Used in Kubernetes kube-apiserver logs with WARNING prefix, 6-digit microsecond precision
    - "'E'MMdd HH:mm:ss.S=ERROR"         # Used in Kubernetes kube-apiserver logs with ERROR prefix, 1-digit microsecond precision
    - "'E'MMdd HH:mm:ss.SS=ERROR"        # Used in Kubernetes kube-apiserver logs with ERROR prefix, 2-digit microsecond precision
    - "'E'MMdd HH:mm:ss.SSS=ERROR"       # Used in Kubernetes kube-apiserver logs with ERROR prefix, 3-digit microsecond precision
    - "'E'MMdd HH:mm:ss.SSSS=ERROR"      # Used in Kubernetes kube-apiserver logs with ERROR prefix, 4-digit microsecond precision
    - "'E'MMdd HH:mm:ss.SSSSS=ERROR"     # Used in Kubernetes kube-apiserver logs with ERROR prefix, 5-digit microsecond precision
    - "'E'MMdd HH:mm:ss.SSSSSS=ERROR"    # Used in Kubernetes kube-apiserver logs with ERROR prefix, 6-digit microsecond precision
    - "'F'MMdd HH:mm:ss.S=CRITICAL"      # Used in Kubernetes kube-apiserver logs with FATAL prefix, 1-digit microsecond precision
    - "'F'MMdd HH:mm:ss.SS=CRITICAL"     # Used in Kubernetes kube-apiserver logs with FATAL prefix, 2-digit microsecond precision
    - "'F'MMdd HH:mm:ss.SSS=CRITICAL"    # Used in Kubernetes kube-apiserver logs with FATAL prefix, 3-digit microsecond precision
    - "'F'MMdd HH:mm:ss.SSSS=CRITICAL"   # Used in Kubernetes kube-apiserver logs with FATAL prefix, 4-digit microsecond precision
    - "'F'MMdd HH:mm:ss.SSSSS=CRITICAL"  # Used in Kubernetes kube-apiserver logs with FATAL prefix, 5-digit microsecond precision
    - "'F'MMdd HH:mm:ss.SSSSSS=CRITICAL" # Used in Kubernetes kube-apiserver logs with FATAL prefix, 6-digit microsecond precision

group

Configure the Group initializer to combine multi-line events into TenXObject group instances.

Below is the default configuration from: group/config.yaml.

Edit Online

# 🔟❎ 'run' event grouping configuration

# Group  sequences of TenXObjects to filter, aggregate and output as a single logical unit.
# To learn more see https://doc.log10x.com/run/transform/group/

# Set the 10x pipeline to 'run'
tenx: run

# =============================== Dependencies ================================

include: run/modules/initialize/group

# =============================== Group Options ===============================


# 'indicators'  specifies a list of `value:state` pairs that determine if a log line's start marks a group head (`true`) or child (`false`).
group:

  # 'indicators' specifies a list of strings that, when matched at the start of a log line's text, designate it as a group head.
  # Unmatched lines default to false, indicating they are group children.
  indicators:
    - '192.'              # Indicates a private IP address, common in web server logs (e.g., "192.168.1.1 - - [...]")
    - '10.'               # Indicates a private IP range, often in Kubernetes or internal network logs (e.g., "10.244.0.125 - - [...]")
    - '172.'              # Indicates a private IP range, typical in enterprise network logs (e.g., "172.16.0.1 - - [...]")
    - '127.'              # Indicates localhost, a common web server log initiator (e.g., "127.0.0.1 - - [...]")
    - 'GET '              # Indicates an HTTP GET request, marking the start of a web transaction log (e.g., "GET /index.html HTTP/1.1")
    - 'POST '             # Indicates an HTTP POST request, marking the start of a web transaction log (e.g., "POST /api HTTP/1.1")
    - 'PUT '              # Indicates an HTTP PUT request, marking the start of a web transaction log (e.g., "PUT /resource HTTP/1.1")
    - 'DELETE '           # Indicates an HTTP DELETE request, marking the start of a web transaction log (e.g., "DELETE /resource HTTP/1.1")
    - 'HEAD '             # Indicates an HTTP HEAD request, marking the start of a web transaction log (e.g., "HEAD /index.html HTTP/1.1")
    - 'OPTIONS '          # Indicates an HTTP OPTIONS request, marking the start of a web transaction log (e.g., "OPTIONS /api HTTP/1.1")
    - 'HTTP/'             # Indicates an HTTP protocol version, marking the start of a web transaction log (e.g., "GET /index.html HTTP/1.1")
    - 'kernel:'           # Indicates a Linux kernel log entry, marking the start of a system event (e.g., "kernel: [0.123456] Device initialized")
    - 'sshd['             # Indicates an SSH daemon log entry, marking the start of a security event (e.g., "sshd[1234]: Accepted password ...")
    - 'systemd['          # Indicates a systemd service log entry, marking the start of a system service event (e.g., "systemd[1]: Started service ...")
    - 'cron['             # Indicates a cron daemon log entry, marking the start of a scheduled task event (e.g., "cron[1234]: Running job ...")
    - 'syslog:'           # Indicates a syslog message, marking the start of a system log event (e.g., "syslog: Message ...")
    - 'rsyslogd:'         # Indicates an rsyslog daemon log entry, marking the start of a logging system event (e.g., "rsyslogd: Log started ...")
    - 'auditd['           # Indicates an audit daemon log entry, marking the start of a security audit event (e.g., "auditd[1234]: Audit event ...")
    - 'daemon:'           # Indicates a syslog daemon facility log, marking the start of a system service event (e.g., "daemon: Service started ...")
    - 'user:'             # Indicates a syslog user facility log, marking the start of a user-related event (e.g., "user: User logged in ...")
    - 'local0:'           # Indicates a syslog local facility log, marking the start of a custom system event (e.g., "local0: Custom message ...")
    - 'local1:'           # Indicates a syslog local facility log, marking the start of a custom system event (e.g., "local1: Custom message ...")
    - 'level='            # Indicates a structured log key, marking the start of a key-value log entry (e.g., "level=info msg=Started")
    - 'msg='              # Indicates a structured log key, marking the start of a message log entry (e.g., "msg=Application started")
    - 'message='          # Indicates a structured log key, marking the start of a message log entry (e.g., "message=Application started")
    - 'event='            # Indicates a structured log key, marking the start of an event log entry (e.g., "event=Service startup")
    - 'thread='           # Indicates a structured log key, marking the start of a thread-specific log entry (e.g., "thread=main Processing ...")
    - 'Starting '         # Indicates the start of a process initiation log (e.g., "Starting server on port 8080")
    - 'Stopping '         # Indicates the start of a process termination log (e.g., "Stopping service ...")
    - 'Running '          # Indicates the start of a process status log (e.g., "Running task ...")
    - 'Listening '        # Indicates the start of a network service log (e.g., "Listening on port 8080 ...")
    - 'Connecting '       # Indicates the start of a connection attempt log (e.g., "Connecting to database ...")
    - 'Connected '        # Indicates the start of a successful connection log (e.g., "Connected to database ...")
    - 'Disconnected '     # Indicates the start of a disconnection log (e.g., "Disconnected from server ...")
    - 'Processing '       # Indicates the start of a task processing log (e.g., "Processing request ...")
    - 'Received '         # Indicates the start of a data reception log (e.g., "Received message ...")
    - 'Sent '             # Indicates the start of a data transmission log (e.g., "Sent response ...")
    - 'User '             # Indicates the start of a user action log (e.g., "User logged in ...")
    - 'Authentication '   # Indicates the start of an authentication log (e.g., "Authentication successful ...")
    - 'Authorized '       # Indicates the start of an authorization log (e.g., "Authorized user access ...")
    - 'Failed '           # Indicates the start of a failure log (e.g., "Failed login attempt ...")
    - 'kubelet:=true'     # Indicates a Kubernetes kubelet log entry, marking the start of a node event (e.g., "kubelet: Starting kubelet")
    - 'pod:=true'         # Indicates a Kubernetes pod log entry, marking the start of a pod event (e.g., "pod: Starting container")
    - 'container:=true'   # Indicates a Kubernetes container log entry, marking the start of a container event (e.g., "container: Started")
    - 'namespace:=true'   # Indicates a Kubernetes namespace log entry, marking the start of a namespace event (e.g., "namespace: Created")
    - 'Traceback '        # Indicates the start of a Python stack trace (e.g., "Traceback (most recent call last):")
    - 'File "'            # Indicates a Python stack trace line (e.g., "File "/script.py", line 10")
    - 'Trace:'            # Indicates a Node.js console trace (e.g., "Trace: Show me")
    - 'Error:'            # Indicates a Node.js error log (e.g., "Error: Something went wrong")
    - 'Warning:'          # Indicates a Node.js warning log (e.g., "Warning: Deprecated method")
    - 'Exception in thread ' # Indicates a Java exception header (e.g., "Exception in thread 'main'")
    - 'goroutine '        # Indicates a Go goroutine stack trace (e.g., "goroutine 1 [running]:")
    - 'panic:'            # Indicates a Go panic (e.g., "panic: runtime error")
    - 'thread '           # Indicates a Rust thread panic (e.g., "thread 'main' panicked at")
    - 'stack backtrace:'  # Indicates a Rust backtrace header (e.g., "stack backtrace:")
    - 'PHP Warning:'      # Indicates a PHP warning (e.g., "PHP Warning: Undefined variable")
    - 'PHP Fatal error:'  # Indicates a PHP fatal error (e.g., "PHP Fatal error: Out of memory")
    - 'in /'              # Indicates a PHP/Ruby file path in stack trace (e.g., "in /path/to/file.php:10")
    - 'Exception:'        # Indicates a C# exception (e.g., "Exception: Invalid operation")
    - 'terminate called'  # Indicates a C++ termination (e.g., "terminate called after throwing an instance of 'std::exception'")
    - 'syslog:'           # Indicates a Linux syslog message (e.g., "syslog: Message ...")
    - 'IN='               # Indicates an iptables firewall input log (e.g., "IN=eth0 OUT=")
    - 'OUT='              # Indicates an iptables firewall output log (e.g., "OUT=eth0 SRC=")
    - 'SRC='              # Indicates an iptables firewall source IP log (e.g., "SRC=192.168.1.1 DST=")
    - 'DST='              # Indicates an iptables firewall destination IP log (e.g., "DST=10.0.0.1 LEN=")
    - 'KafkaServer:'      # Indicates a Kafka server log (e.g., "KafkaServer: Starting Kafka server")
    - 'Redis:'            # Indicates a Redis server log (e.g., "Redis: Server initialized")

  # 'negators' specifies patterns that mark a line as a continuation of a previous event (e.g., stack trace lines).
  # Lines matching these patterns are NOT standalone events and typically don't need their own message pattern.
  # Events that are NOT negators (isStandalone=true) will get a message even without timestamp/severity.
  negators:
    # Java/Kotlin/Scala stack traces
    - "\tat "             # Java stack frame (e.g., "\tat com.example.MyClass.method(MyClass.java:42)")
    - "    at "           # Java stack frame with spaces (e.g., "    at com.example.MyClass.method")
    - "\t... "            # Java truncated stack (e.g., "\t... 15 more")
    - "    ... "          # Java truncated stack with spaces
    - "Caused by: "       # Java chained exception (e.g., "Caused by: java.io.IOException")
    - "Suppressed: "      # Java suppressed exception (e.g., "Suppressed: java.lang.Exception")

    # .NET/C# stack traces
    - "   at "            # .NET stack frame (e.g., "   at MyNamespace.MyClass.Method()")
    - "--- End of "       # .NET inner exception marker (e.g., "--- End of inner exception stack trace ---")
    - " ---> "            # .NET inner exception chain

    # Python stack traces
    - "  File \""         # Python stack frame (e.g., '  File "/path/to/script.py", line 10')
    - "    raise "        # Python raise statement in traceback
    - "    return "       # Python return statement in traceback

    # Node.js/JavaScript stack traces
    - "    at "           # Node.js stack frame (e.g., "    at Object.<anonymous> (/path/file.js:10:15)")
    - "    at new "       # Node.js constructor stack frame
    - "    at Module."    # Node.js module stack frame
    - "    at Object."    # Node.js object stack frame

    # Go stack traces
    - "\t/"               # Go stack frame path (e.g., "\t/go/src/main.go:42 +0x123")
    - "created by "       # Go goroutine creator (e.g., "created by main.main")

    # Ruby stack traces
    - "\tfrom "           # Ruby stack frame (e.g., "\tfrom /path/to/file.rb:10:in `method'")
    - "        from "     # Ruby stack frame with spaces

    # Rust stack traces
    - "             at "  # Rust source location (13 spaces + at)
    - "  --> "            # Rust error pointer

    # PHP stack traces
    - "#0 "               # PHP stack frame (e.g., "#0 /path/to/file.php(10): function()")
    - "#1 "               # PHP stack frame
    - "#2 "               # PHP stack frame
    - "#3 "               # PHP stack frame
    - "#4 "               # PHP stack frame
    - "#5 "               # PHP stack frame
    - "  thrown in "      # PHP exception location

Event Outputs

Activate Event stream outputs to write TenXObject and template values to event stream outputs (e.g., stdout, files).

Below is the default configuration from: stdout/config.yaml.

Edit Online

# 🔟❎ 'run' stdout output configuration

# Configure stdout/err streams for writing TenXObject instance and template values.
# To learn more see https://doc.log10x.com/run/output/event/stdout

# Set the 10x pipeline to 'run'
tenx: run

# =============================== Dependencies ================================

include: run/modules/output/event/stdout

# ============================= Stdout Options ================================

# Multiple stdout outputs can be defined below
stdout:

  # ---------------------------10x Encoding Output ----------------------------

    # Encode TenXObjects: https://doc.log10x.com/run/transform/#template-encoding

    # 'target' can be SYSTEM_OUT or SYSTEM_ERR
  - target: SYSTEM_OUT

    # 'filter' sets a JavaScript expression that TenXObjects must evaluate as truthy to write to the output.
    #  To learn more see https://doc.log10x.com/run/output/regulate/#filter-expressions
    filter: isObject                

    # 'fields' defines the fields to write for each TenXObject sent to this output.
    #  To learn more see https://doc.log10x.com/run/output/stream/#outputfields  
    fields: 
      - encode() # https://doc.log10x.com/api/js/#TenXObject+encode

  # ----------------------------- Decode Output -------------------------------

    # Template-decode TenXObjects: https://doc.log10x.com/run/transform/#expand

  - target: SYSTEM_OUT

    filter: isEncoded  # https://doc.log10x.com/api/js/#TenXBaseObject+isEncoded   

    fields: 
      - text           # https://doc.log10x.com/api/js/#TenXBaseObject+text

  # ---------------------------- Template Output ------------------------------

    # Writes TenXTemplate values: https://doc.log10x.com/run/transform/#template

  - target: SYSTEM_OUT

    # 'writeTemplates' controls whether to write new TenXObjects templates to stdout. 
    # To learn more see https://doc.log10x.com/run/output/event/stdout/#stdoutwritetemplates
    writeTemplates: true 

  # ----------------------------- Summary Output ------------------------------

    # Writes aggregated TenXSummaries: https://doc.log10x.com/run/aggregate/

  - target: SYSTEM_OUT

    filter: isSummary   # https://doc.log10x.com/api/js/#TenXBaseObject+isSummary                        

    fields: 
      - $=yield TenXEnv.get("enrichmentFields") # https://doc.log10x.com/run/initialize/#enrichmentFields
      - summaryVolume                           # https://doc.log10x.com/api/js/#TenXSummary+summaryVolume
      - summaryBytes                            # https://doc.log10x.com/api/js/#TenXSummary+summaryBytes
      - summaryTotals                           # https://doc.log10x.com/api/js/#TenXSummary+summaryTotals

Advanced Config Files

To configure advanced options (optional) for the MCP test-drive app, Edit these files:

Symbols

Below is the default configuration from: symbol/config.yaml.

Edit Online

# 🔟❎ 'run' symbol file configuration

# Loads symbol library files to transform events into well-defined TenXObjects.
# To learn more see https://doc.log10x.com/run/symbol

# Set the 10x pipeline to 'run'
tenx: run

# ============================ Symbol Options =================================

symbol:

  # 'paths' specifies the file/folder locations to scan for symbol library files.
  #  To learn more see https://doc.log10x.com/run/symbol/#symbolpaths
  paths:
    - $=path("data/shared/symbols", false)
    - $=path("<TENX_SYMBOLS_PATH>",  false)

  literals: []

Template

Below is the default configuration from: template/config.yaml.

Edit Online

# 🔟❎ 'run' template file configuration

# Load TenXTemplates .json files that define the structure/schema of TenXObjects.
# To learn more see https://doc.log10x.com/run/template/

# Set the 10x pipeline to 'run'
tenx: run

# =============================== Template ===================================

template:
  # 'files' specifies GLOB pattern for finding JSON-encoded TenXTemplates.
  files:
    - $=path("data/templates/*.json")
    - $=path("data/sample/output/*.json")

  # 'cacheSize' controls the maximum total byte size of templates held
  #  in the in-memory cache vs. on disk. Set to 0 to disable pruning.
  cacheSize: $=parseBytes("10MB")

# =============================== Variable ===================================

var:
  # 'placeholder' specifies a character to use when encoding a TenXTemplate
  #  to signify the location of a runtime variable value.
  placeholder: "$"

  # 'maxRecurIndexes' controls the maximum number of variable values to reuse.
  maxRecurIndexes: 10

# =============================== Timestamp ==================================

timestamp:
  # 'prefix' specifies a prefix for a TenXTemplate's timestamp tokens.
  prefix: (

  # 'postfix' specifies a postfix for a TenXTemplate's timestamp tokens.
  postfix: )

Transform

Configure the Transform to transform log and trace events into well-defined TenXObjects.

Below is the default configuration from: group/config.yaml.

Edit Online

# 🔟❎ 'run' event grouping configuration

# Group  sequences of TenXObjects to filter, aggregate and output as a single logical unit.
# To learn more see https://doc.log10x.com/run/transform/group/

# Set the 10x pipeline to 'run'
tenx: run

# =============================== Group Options ===============================

group:

  # 'filters' specify JavaScript expressions an TenXObject instance/group must 
  #  evaluate as truthy against to be written to output
  filters: []

  # 'maxSize' defines the maximum number of TenXObjects to group
  #  before the group is sealed and forwarded into the pipeline. 
  #  Subsequent TenXObjects can form a new group.
  maxSize: 20000

  # 'flushTimeout' defines the max interval (e.g., 10s) to wait for 
  #  new events to be read from an input stream before it flushes any
  #  pending TenXObjects group into the pipeline.
  #  This mechanism is designed to avoid latencies in dispatching pending event
  #  groups to output destinations.
  flushTimeout: $=parseDuration("5s")

  # 'async' specifies whether to sequence and group TenXObjects in a dedicated thread
  async: true

This app is defined in mcp/app.yaml.

Next: FAQ

Validate

What it does

Reproduce a log10x_validate call locally

Why narrower than @apps/dev

Config Files

Main Config

Inputs

Initializers

message

level

group

Event Outputs

Advanced Config Files

Symbols

Template

Transform

Reproduce a `log10x_validate` call locally

Why narrower than `@apps/dev`