Getting Started

BlazeRules runs YAML rules over event batches. Start by choosing how records enter the engine.

Choose An Input Path

You have	Use	Next page
NDJSON bytes or JSON logs	`RuleEngine.evaluate_ndjson(...)`	Quickstart
PyArrow / Arrow batches	`RuleEngine.evaluate_batch(...)`	Python API
Application logs over HTTP	`blazerules_agent --input http`	HTTP Logs
Terminal, stdout, stderr, or service logs	`blazerules_agent --input stdin`	stdin Logs
A log file to follow	`blazerules_agent --input file_tail`	File Tail
Kubernetes pod logs	Helm chart / DaemonSet	Kubernetes Logs
Kafka topics	`blazerules_io` Kafka loop	Kafka Streaming
Arrow IPC, Avro, or Protobuf	`blazerules_io` decoders	Binary Formats
S3 or local files	`blazerules_io.read_*`	S3 Resources

All of these paths end at the same batch engine. The input adapter changes; rule semantics do not.

Install

pip install blazerules
python -c "import blazerules, blazerules_io; print(blazerules.__version__, blazerules.simd_backend())"

Minimal Rule

schema_version: "2.1"
ruleset:
  name: app-log-rules
  version: "1.0.0"
  rules:
    - id: error_payment
      action: REVIEW
      conditions:
        and:
          - field: level
            op: eq
            value: error
          - field: message
            op: contains
            value: payment

Save it as rules.yaml.

Evaluate NDJSON In Python

import blazerules

engine = blazerules.RuleEngine()
engine.load_rules("rules.yaml")

payload = b"""
{"event_id":"e1","level":"info","message":"checkout started","amount":30}
{"event_id":"e2","level":"error","message":"payment failed","amount":900}
"""

result = engine.evaluate_ndjson(payload)
print(result.decisions)
print(result.match_counts)

CLI equivalent: evaluate through the local agent

printf '%s\n' \
  '{"event_id":"e1","level":"info","message":"checkout started","amount":30}' \
  '{"event_id":"e2","level":"error","message":"payment failed","amount":900}' | \
  blazerules_agent --rules rules.yaml --input stdin --output stdout

Run A Local HTTP Ingest Endpoint

blazerules_agent \
  --rules rules.yaml \
  --input http \
  --host 127.0.0.1 \
  --port 9480 \
  --batch-size 2048 \
  --flush-ms 100 \
  --output ndjson \
  --output-path decisions.ndjson

Python equivalent: start the HTTP agent

import subprocess

agent = subprocess.Popen([
    "blazerules_agent",
    "--rules", "rules.yaml",
    "--input", "http",
    "--host", "127.0.0.1",
    "--port", "9480",
    "--batch-size", "2048",
    "--flush-ms", "100",
    "--output", "ndjson",
    "--output-path", "decisions.ndjson",
])

Send records:

curl -X POST http://127.0.0.1:9480/v1/logs \
  --data-binary $'{"event_id":"e2","level":"error","message":"payment failed","amount":900}\n'

Python equivalent: send the same HTTP batch

import urllib.request

payload = b'{"event_id":"e2","level":"error","message":"payment failed","amount":900}\n'
urllib.request.urlopen("http://127.0.0.1:9480/v1/logs", data=payload).read()

Inspect Decisions

blazerules_dashboard \
  --decision-log decisions.ndjson \
  --dead-letter-log dead_letters.ndjson \
  --rules rules.yaml

Python equivalent: start the dashboard process

import subprocess

subprocess.Popen([
    "blazerules_dashboard",
    "--decision-log", "decisions.ndjson",
    "--dead-letter-log", "dead_letters.ndjson",
    "--rules", "rules.yaml",
])

Open http://127.0.0.1:9470.

Where To Go Next

Ingestion Overview

Every supported input type and where it fits.

Quickstart

JSON and Arrow examples using the Python module.

HTTP Logs

POST NDJSON records to the local agent.

File Tail

Tail application, stdout, stderr, or pod log files.