# nextronsystems/jsonlog architecture

> Architecture diagram of the GitHub repository nextronsystems/jsonlog, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nextronsystems/jsonlog
- Repository: https://github.com/nextronsystems/jsonlog

## Overview

This Go library models THOR forensic-scanner logs across three format versions and provides parsing, text-log conversion, and JSON Schema generation. The principal workflow is to pass JSON event data to the version-aware parser, which decodes the matching version and returns a version-agnostic event. The README documents the formatter and schema-generation capabilities; their exact internal wiring is not shown in the sampled source, so the graph limits those links to documented behavior.

Main entry points: [`thorlog/parser/parser.go`](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/parser/parser.go) (Version dispatcher), [`thorlog/common/event.go`](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/common/event.go) (Common event API), [`thorlog/v1/event.go`](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v1/event.go) (V1 event model), [`thorlog/v2/event.go`](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v2/event.go) (V2 event model)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_parsing["Event parsing"]
  node_parser["Version dispatcher<br/>[parser.go]"]
  node_common_event["Common event API<br/>[event.go]"]
end

subgraph group_formats["Versioned formats"]
  node_v1["V1 event model<br/>[event.go]"]
  node_v1_fields["V1 fields<br/>[fields.go]"]
  node_v2["V2 event model<br/>[event.go]"]
  node_v2_fields["Open fields<br/>[fields.go]"]
  node_v3_objects["V3 object types"]
  node_v3_decode["V3 object decoder<br/>[unmarshal.go]"]
end

subgraph group_outputs["Output capabilities"]
  node_formatter["Text formatter<br/>[textlog.go]"]
  node_schema_generator["Schema generator<br/>[generateschema.go]"]
end

subgraph group_support["Reference utilities"]
  node_reference["Object references<br/>[reference.go]"]
  node_pointer["JSON Pointer<br/>[pointer.go]"]
  node_pointer_resolve["Pointer resolution<br/>[resolve.go]"]
end

node_user(("Library user"))
node_json_input["JSON event"]
node_text_output["Human-readable log"]
node_schema_output["JSON Schema"]

node_user -->|"provides"| node_json_input
node_json_input -->|"parses"| node_parser
node_parser -->|"decodes V1"| node_v1
node_parser -->|"decodes V2"| node_v2
node_parser -->|"decodes V3"| node_v3_decode
node_v3_decode -->|"creates typed object"| node_v3_objects
node_v1 -->|"implements"| node_common_event
node_v2 -->|"implements"| node_common_event
node_v3_objects -->|"includes events"| node_common_event
node_user -->|"formats object"| node_formatter
node_formatter -->|"produces"| node_text_output
node_user -->|"requests schema"| node_schema_generator
node_schema_generator -->|"generates"| node_schema_output
node_reference -->|"encodes pointer"| node_pointer
node_pointer_resolve -->|"resolves pointer"| node_pointer

click node_parser "https://github.com/nextronsystems/jsonlog/blob/master/thorlog/parser/parser.go"
click node_common_event "https://github.com/nextronsystems/jsonlog/blob/master/thorlog/common/event.go"
click node_v1 "https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v1/event.go"
click node_v1_fields "https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v1/fields.go"
click node_v2 "https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v2/event.go"
click node_v2_fields "https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v2/fields.go"
click node_v3_objects "https://github.com/nextronsystems/jsonlog/tree/master/thorlog/v3"
click node_v3_decode "https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v3/unmarshal.go"
click node_formatter "https://github.com/nextronsystems/jsonlog/blob/master/textlog.go"
click node_schema_generator "https://github.com/nextronsystems/jsonlog/blob/master/thorlog/jsonschema/generateschema.go"
click node_reference "https://github.com/nextronsystems/jsonlog/blob/master/reference.go"
click node_pointer "https://github.com/nextronsystems/jsonlog/blob/master/jsonpointer/pointer.go"
click node_pointer_resolve "https://github.com/nextronsystems/jsonlog/blob/master/jsonpointer/resolve.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_parser,node_common_event,node_user toneBlue
class node_v1,node_v1_fields,node_v2,node_v2_fields,node_v3_objects,node_v3_decode toneAmber
class node_formatter,node_schema_generator toneMint
class node_reference,node_pointer,node_pointer_resolve toneRose
class node_json_input,node_text_output,node_schema_output toneIndigo
```

## Components

### Event parsing

- [Version dispatcher](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/parser/parser.go): `thorlog/parser/parser.go`
- [Common event API](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/common/event.go): `thorlog/common/event.go`

### Versioned formats

- [V1 event model](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v1/event.go): `thorlog/v1/event.go`
- [V1 fields](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v1/fields.go): `thorlog/v1/fields.go`
- [V2 event model](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v2/event.go): `thorlog/v2/event.go`
- [Open fields](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v2/fields.go): `thorlog/v2/fields.go`
- [V3 object types](https://github.com/nextronsystems/jsonlog/tree/master/thorlog/v3): `thorlog/v3`
- [V3 object decoder](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/v3/unmarshal.go): `thorlog/v3/unmarshal.go`

### Output capabilities

- [Text formatter](https://github.com/nextronsystems/jsonlog/blob/master/textlog.go): `textlog.go`
- [Schema generator](https://github.com/nextronsystems/jsonlog/blob/master/thorlog/jsonschema/generateschema.go): `thorlog/jsonschema/generateschema.go`

### Reference utilities

- [Object references](https://github.com/nextronsystems/jsonlog/blob/master/reference.go): `reference.go`
- [JSON Pointer](https://github.com/nextronsystems/jsonlog/blob/master/jsonpointer/pointer.go): `jsonpointer/pointer.go`
- [Pointer resolution](https://github.com/nextronsystems/jsonlog/blob/master/jsonpointer/resolve.go): `jsonpointer/resolve.go`

### Other components

- **Library user**
- **JSON event**
- **Human-readable log**
- **JSON Schema**

## Connections

- Library user → JSON event: provides
- JSON event → Version dispatcher: parses
- Version dispatcher → V1 event model: decodes V1
- Version dispatcher → V2 event model: decodes V2
- Version dispatcher → V3 object decoder: decodes V3
- V3 object decoder → V3 object types: creates typed object
- V1 event model → Common event API: implements
- V2 event model → Common event API: implements
- V3 object types → Common event API: includes events
- Library user → Text formatter: formats object
- Text formatter → Human-readable log: produces
- Library user → Schema generator: requests schema
- Schema generator → JSON Schema: generates
- Object references → JSON Pointer: encodes pointer
- Pointer resolution → JSON Pointer: resolves pointer