How nextronsystems/jsonlog works
This Go library models THOR forensic-scanner logs across three format versions and provides parsing, text-log conversion, and JSON Schema generation. The principal workflow is to pass JSON event data to the version-aware parser, which decodes the matching version and returns a version-agnostic event. The README documents the formatter and schema-generation capabilities; their exact internal wiring is not shown in the sampled source, so the graph limits those links to documented behavior.
Main entry points: parser.go Version dispatcher · common/event.go Common event API · v1/event.go V1 event model · v2/event.go V2 event model
Components 17
Event parsing
- Version dispatcher
thorlog/parser/parser.go - Common event API
thorlog/common/event.go
Versioned formats
- V1 event model
thorlog/v1/event.go - V1 fields
thorlog/v1/fields.go - V2 event model
thorlog/v2/event.go - Open fields
thorlog/v2/fields.go - V3 object types
thorlog/v3 - V3 object decoder
thorlog/v3/unmarshal.go
Output capabilities
- Text formatter
textlog.go - Schema generator
thorlog/jsonschema/generateschema.go
Reference utilities
- Object references
reference.go - JSON Pointer
jsonpointer/pointer.go - Pointer resolution
jsonpointer/resolve.go
Other components
- Library user
- JSON event
- Human-readable log
- JSON Schema
Connections 15
- Library user → JSON event: provides
- JSON event → Version dispatcher: parses
- Version dispatcher → V1 event model: decodes V1
- Version dispatcher → V2 event model: decodes V2
- Version dispatcher → V3 object decoder: decodes V3
- V3 object decoder → V3 object types: creates typed object
- V1 event model → Common event API: implements
- V2 event model → Common event API: implements
- V3 object types → Common event API: includes events
- Library user → Text formatter: formats object
- Text formatter → Human-readable log: produces
- Library user → Schema generator: requests schema
- Schema generator → JSON Schema: generates
- Object references → JSON Pointer: encodes pointer
- Pointer resolution → JSON Pointer: resolves pointer