diff --git a/pkg/agentdrain/miner.go b/pkg/agentdrain/miner.go index 710dc27b375..6983678facb 100644 --- a/pkg/agentdrain/miner.go +++ b/pkg/agentdrain/miner.go @@ -48,7 +48,7 @@ func (m *Miner) Train(line string) (*MatchResult, error) { m.mu.Lock() defer m.mu.Unlock() - result, _ := m.match(tokens) + result, _ := m.findBestMatchingCluster(tokens) if result != nil { // Merge and update existing cluster. c, _ := m.store.get(result.ClusterID) @@ -73,10 +73,10 @@ func (m *Miner) Train(line string) (*MatchResult, error) { }, nil } -// match is the internal (non-locking) lookup. Must be called with mu held. -func (m *Miner) match(tokens []string) (*MatchResult, bool) { +// findBestMatchingCluster is the internal (non-locking) lookup. Must be called with mu held. +func (m *Miner) findBestMatchingCluster(tokens []string) (*MatchResult, bool) { candidates := m.tree.search(tokens, m.cfg.Depth, m.cfg.ParamToken) - minerLog.Printf("match: searching %d candidate cluster(s) for %d token(s)", len(candidates), len(tokens)) + minerLog.Printf("findBestMatchingCluster: searching %d candidate cluster(s) for %d token(s)", len(candidates), len(tokens)) bestSim := -1.0 var best *Cluster for _, id := range candidates { @@ -91,11 +91,11 @@ func (m *Miner) match(tokens []string) (*MatchResult, bool) { } } if best == nil || bestSim < m.cfg.SimThreshold { - minerLog.Printf("match: no cluster matched (best_sim=%.2f, threshold=%.2f)", bestSim, m.cfg.SimThreshold) + minerLog.Printf("findBestMatchingCluster: no cluster matched (best_sim=%.2f, threshold=%.2f)", bestSim, m.cfg.SimThreshold) return nil, false } params := extractParams(tokens, best.Template, m.cfg.ParamToken) - minerLog.Printf("match: matched cluster id=%d, similarity=%.2f, params=%d", best.ID, bestSim, len(params)) + minerLog.Printf("findBestMatchingCluster: matched cluster id=%d, similarity=%.2f, params=%d", best.ID, bestSim, len(params)) return &MatchResult{ ClusterID: best.ID, Template: strings.Join(best.Template, " "), @@ -135,7 +135,7 @@ func (m *Miner) AnalyzeEvent(evt AgentEvent) (*MatchResult, *AnomalyReport, erro } m.mu.RLock() - inferResult, _ := m.match(tokens) + inferResult, _ := m.findBestMatchingCluster(tokens) m.mu.RUnlock() isNew := inferResult == nil diff --git a/pkg/agentdrain/tree.go b/pkg/agentdrain/tree.go index f16bf58d446..53e053b041a 100644 --- a/pkg/agentdrain/tree.go +++ b/pkg/agentdrain/tree.go @@ -35,7 +35,7 @@ func (t *parseTree) addCluster(tokens []string, clusterID int, depth int, maxChi if t.root[n] == nil { t.root[n] = make(map[string]*treeNode) } - key := t.firstKey(tokens, depth, paramToken) + key := t.computeTreeBucketKey(tokens, depth, paramToken) leaf := t.root[n][key] if leaf == nil { leaf = newTreeNode() @@ -53,7 +53,7 @@ func (t *parseTree) search(tokens []string, depth int, paramToken string) []int treeLog.Printf("Search: no clusters for token_count=%d", n) return nil } - key := t.firstKey(tokens, depth, paramToken) + key := t.computeTreeBucketKey(tokens, depth, paramToken) leaf, ok := byCount[key] if !ok { // Also try the wildcard bucket. @@ -69,9 +69,9 @@ func (t *parseTree) search(tokens []string, depth int, paramToken string) []int return out } -// firstKey returns the routing key derived from the first meaningful token. +// computeTreeBucketKey returns the routing key derived from the first meaningful token. // When depth == 1, all lines with the same length share a single bucket. -func (t *parseTree) firstKey(tokens []string, depth int, paramToken string) string { +func (t *parseTree) computeTreeBucketKey(tokens []string, depth int, paramToken string) string { if depth <= 1 || len(tokens) == 0 { return "*" }