ishan1o1/logbox

Purpose and Runtime Shape

This repository is a log-observability and incident root-cause-analysis (RCA) system. It combines a React/Vite frontend with a Node.js server that appears to query Elasticsearch-backed logs, present analytics dashboards, and generate RCA output through an AI-provider abstraction.

Key runtime entry points:

• Frontend bootstrap: frontend/src/main.jsx, application composition: frontend/src/App.jsx

• Backend HTTP process: server/server.js

• Containerized local environment: docker-compose.yml

Frontend Application Shell and Access Control

The frontend is a single-page application organized around dashboard, authentication, and RCA routes/pages. Authentication and theme state are shared through React contexts; protected route handling separates authenticated operational views from login/signup access.

Core paths:

• frontend/src/context/AuthContext.jsx

• frontend/src/components/ProtectedRoute.jsx

• frontend/src/pages/Login.jsx

• frontend/src/pages/AdminDashboard.jsx

Log Analytics Dashboard

The admin dashboard composes log-oriented operational views: tabular/list displays, filtering, duration selection, charts, error-rate summaries, and incident cards. These components form the primary analyst workflow for inspecting indexed events and recognizing incidents.

Core paths:

• frontend/src/pages/AdminDashboard.jsx

• frontend/src/components/AnalyticsOverview.jsx

• frontend/src/components/LogTable.jsx

• frontend/src/components/LogFilters.jsx

• frontend/src/components/ErrorRateCards.jsx

The likely UI data boundary is the service layer, which isolates HTTP/API calls from visualization components:

• frontend/src/services/analyticsApi.js

• frontend/src/components/LogChart.jsx

RCA Workflow

RCA is a distinct frontend-to-backend capability. The UI presents an RCA page and modal interaction, while the server module owns request routing, orchestration, prompt construction, and AI invocation. This separation allows analysis logic and provider selection to evolve without embedding AI details in the client.

Core paths:

• frontend/src/pages/RCA.jsx

• frontend/src/components/RCAModal.jsx

• frontend/src/services/rcaApi.js

• server/modules/rca/rca.routes.js

• server/modules/rca/rca.controller.js

• server/modules/rca/rca.service.js

Control flow: user selects or investigates an incident/log context → frontend RCA service submits analysis request → controller delegates to RCA service → service assembles/uses an AI analysis result → response is rendered in the RCA page/modal.

AI Provider Boundary

AI-specific behavior is modularized under the RCA module. Prompt definition and provider access are separated from RCA transport and business orchestration, creating a clear boundary for changing models or credentials.

Core paths:

• server/modules/rca/rca.ai.service.js

• server/modules/rca/rca.prompt.js

• server/modules/rca/ai/provider.js

server/testGemini.js indicates Gemini may be a supported or evaluated external AI service, but production provider configuration should be verified in the implementation.

Log Storage, Ingestion, and Elasticsearch

Elasticsearch is the apparent primary log datastore. The server includes connection configuration, a log model, index creation support, and buffering, suggesting logs may be accumulated before being written or processed in batches.

Core paths:

• server/config/elasticsearch.js

• server/models/log.js

• server/services/logBuffer.js

• server/utils/createIndex.js

Supporting artifacts such as server/mapping.json, server/indices.json, and server/demo_logs.json likely define index structure and sample/bootstrap data. Elasticsearch is the principal infrastructure dependency and the backend is the boundary between it and the browser.

Deployment and Dependency Boundaries

The repository has independently packaged frontend and server projects:

• frontend/package.json

• server/package.json

The frontend is Vite-based (frontend/vite.config.js), while the server owns Elasticsearch and AI-provider integrations. docker-compose.yml is the central infrastructure composition point and likely coordinates local service startup, including Elasticsearch and application runtime dependencies.