Skip to content

Structure Parser

Structure events read from input using Symbol libraries into typed TenXObjects.

The structuring process breaks down each input event into its discrete values and classifies each value as either a variable, symbols or delimiter using information from the symbol library. An event's structure is defined by its sequence of symbols and delimiter values (excluding variables).

Events sharing the same structure are assigned an TenXTemplate (i.e. hidden class) as a joint schema, similar to a programmatic class that defines the structure of its instances.

Process

The transform process executes the following steps for each input event:

  1. Identify the event's matching TenXTemplate type (i.e., hidden class) using loaded symbol libraries.

  2. If a new cached TenXTemplate is generated on-the-fly for the event:

  3. Initialize the instance using custom JavaScript constructors.

  4. Enrich with calculated fields (e.g., GeoIP) using configured modules.

  5. Group instances together into composite units (e.g., stack traces, multi-line JSON) for aggregation and encoding as a single logical unit.

Members

Each TenXObject instance contains variables unique to its instance as members and a reference to its TenXTemplate (i.e., hidden class). Symbol values serve as static class members shared across all instances of a logical app/infra event.

Each symbol links to its source code/binary origin and its context within the file (e.g., class, field, enum, printout).

Variables

High-cardinality values specific to the current event. These include:

  • Alphanumeric values (e.g., EDC8116I)
  • Formatted/epoch timestamps (e.g., 2022-04-29T18:52:58.114201Z, 1719928783)
  • Host addresses (e.g., 10.10.34.11:9000)
  • Span IDs (e.g., 0x051581bf3cb55c13)

Symbols

Low-cardinality values extracted from source code and binary artifacts at compile-time and stored in a target Symbol library. These include:

  • Class names (e.g., MyClient, MyServer)
  • Function/method names (e.g., info, warn)
  • Enum literals (e.g., STATUS, ERROR, OK)
  • String formats (e.g., "could not connect to {}")
  • JSON/XML field names (e.g. attributes, trace_id)
  • Win/Nix executable strings (e.g., 'sudo, 'connection refused').

Delimiters

Single character values specified via the tokenDelims argument.

Options

Specify the options below to configure the Structure parser:

Name Description
tokenDelims Token delimiters

tokenDelims

Token delimiters.

Type Default
String \<>|. ][:-+/*=\\,{}_();'\"$\t\n@

Defines which characters break a string of event characters into tokens to classify as symbols or variables.


This module is defined in structure/unit.yaml.