Ny central normalisering

src/fgai/logs.py

@@ -7,6 +7,7 @@ from collections.abc import Iterable
 from pathlib import Path
 
 from .models import LogEvent
+from .normalization import canonical_value, normalize_fields
 
 UTM_SUBTYPES = {
     "ips",
@@ -60,7 +61,7 @@ def parse_log_line(line: str) -> LogEvent:
         except json.JSONDecodeError:
             data = {}
         else:
-            return LogEvent(raw=line, fields={str(k).lower(): str(v) for k, v in data.items()})
+            return LogEvent(raw=line, fields=normalize_fields({str(k).lower(): str(v) for k, v in data.items()}))
 
     fields: dict[str, str] = {}
     try:
@@ -74,7 +75,7 @@ def parse_log_line(line: str) -> LogEvent:
         key, value = part.split("=", 1)
         fields[key.strip().lower()] = value.strip().strip('"')
 
-    return LogEvent(raw=line, fields=fields)
+    return LogEvent(raw=line, fields=normalize_fields(fields))
 
 
 def read_events(path: str | Path) -> list[LogEvent]:
@@ -137,7 +138,7 @@ def local_in_failures(events: Iterable[LogEvent], *, limit: int = 10) -> list[di
         if not (policy_type.startswith("local-in") or "local-in" in policy_type or msg == "connection failed"):
             continue
         src_ip = event.src_ip or "unknown"
-        service = event.fields.get("service", event.fields.get("app", "unknown"))
+        service = canonical_value(event.fields, "service") or "unknown"
         policy_id = event.fields.get("policyid", event.fields.get("poluuid", "unknown"))
         counter[(src_ip, service, policy_id)] += 1
     return [