feat(logs): real GetLogGroupFields, ListLogGroupsForQuery, StartLiveTail

[vieiralucas]

Summary

• GetLogGroupFields: walks every event in every stream of the target log group, parses each as JSON, tallies how often each top-level key appears. Synthetic @timestamp / @message / @logStream always surfaced; response uses the documented name + percent shape (not the prior fieldName)
• StartQuery: accepts the AWS-documented logGroupNames and logGroupIdentifiers arrays in addition to the single logGroupName. QueryInfo captures every group/identifier referenced
• ListLogGroupsForQuery: looks up the captured identifiers by queryId and returns them instead of an empty array
• StartLiveTail: echoes the requested logGroupIdentifiers back in sessionStart

Out of scope (documented limitations)

• GetLogObject, GetLogFields, GetLogRecord and anomaly analysis still require Logs Insights query result generation to be wired through the event store; deferred
• Array-style metric filter patterns ([w1, w2 = "ERROR", w3]) — separate parser change

Test plan

• Unit: get_log_group_fields_returns_synthetic_fields_when_no_events, get_log_group_fields_extracts_top_level_keys_from_json_events, list_log_groups_for_query_returns_started_groups, list_log_groups_for_query_returns_array_form_groups
• All 256 existing fakecloud-logs unit tests still green
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo fmt --check clean

---

Summary by cubic

Replace stubbed CloudWatch Logs APIs with real behavior and fix multi‑group query handling. GetLogGroupFields, ListLogGroupsForQuery, StartLiveTail, and GetQueryResults now read recorded events and validate inputs.

• New Features

  • GetLogGroupFields: counts top-level JSON keys across events; always includes @timestamp, @message, @logStream; returns name + percent.
  • StartQuery: accepts logGroupNames and logGroupIdentifiers; queries scan all referenced groups (ARNs resolved, duplicates deduped).
  • ListLogGroupsForQuery: returns captured identifiers for the queryId; unknown queryId now returns ResourceNotFoundException.
  • StartLiveTail: validates logGroupIdentifiers is an array of strings and echoes them in sessionStart.

• Migration

  • GetLogGroupFields response uses name instead of fieldName. Update consumers accordingly.

^{Written for commit ad110ec. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 91.66667% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-logs/src/service/queries.rs	90.90%	9 Missing ⚠️
crates/fakecloud-logs/src/service/misc.rs	89.58%	5 Missing ⚠️
crates/fakecloud-logs/src/service/groups.rs	96.87%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

3 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-logs/src/service/misc.rs">

<violation number="1" location="crates/fakecloud-logs/src/service/misc.rs:579">
P2: `StartLiveTail` silently ignores invalid `logGroupIdentifiers` values instead of returning a validation error.</violation>
</file>

<file name="crates/fakecloud-logs/src/service/queries.rs">

<violation number="1" location="crates/fakecloud-logs/src/service/queries.rs:92">
P1: Multi-group StartQuery inputs are reduced to one `log_group_name`, so `GetQueryResults` only scans a single group instead of all requested groups.</violation>

<violation number="2" location="crates/fakecloud-logs/src/service/queries.rs:429">
P2: Unknown `queryId` is silently treated as success with an empty list; return a not-found error instead.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}