add dynamic

src/fgai/logs.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import shlex
+from collections import Counter
 from collections.abc import Iterable
 from pathlib import Path
 
@@ -117,3 +118,29 @@ def summarize_events(events: Iterable[LogEvent]) -> dict[str, int]:
         if event.severity in {"critical", "high", "alert", "emergency"}:
             summary["critical_or_high"] += 1
     return summary
+
+
+def top_field_values(events: Iterable[LogEvent], field: str, *, limit: int = 10) -> list[dict[str, int | str]]:
+    counter: Counter[str] = Counter()
+    for event in events:
+        value = event.fields.get(field)
+        if value:
+            counter[value] += 1
+    return [{"value": value, "count": count} for value, count in counter.most_common(limit)]
+
+
+def local_in_failures(events: Iterable[LogEvent], *, limit: int = 10) -> list[dict[str, int | str]]:
+    counter: Counter[tuple[str, str, str]] = Counter()
+    for event in events:
+        policy_type = event.fields.get("policytype", event.fields.get("type", "")).lower()
+        msg = event.fields.get("msg", "").lower()
+        if not (policy_type.startswith("local-in") or "local-in" in policy_type or msg == "connection failed"):
+            continue
+        src_ip = event.src_ip or "unknown"
+        service = event.fields.get("service", event.fields.get("app", "unknown"))
+        policy_id = event.fields.get("policyid", event.fields.get("poluuid", "unknown"))
+        counter[(src_ip, service, policy_id)] += 1
+    return [
+        {"src_ip": src_ip, "service": service, "policy": policy_id, "count": count}
+        for (src_ip, service, policy_id), count in counter.most_common(limit)
+    ]