Skip to content

Conversation

@fordN
Copy link
Contributor

@fordN fordN commented Jan 15, 2026

This PR introduces a more flexible subgraph log storage and querying system for Graph Node and enables subgraph logs to be queried through the GraphQL subgraph query API. The implementation supports multiple log storage backends (File, Elasticsearch, and Loki) with a consistent query interface exposed to users in the subgraph's GraphQL schema.

What's new

GraphQL Query API

  • New _logs query field on all subgraph deployments
  • Filter by log level, timestamp range, and text search
  • Structured log entries with metadata (source location, arguments, subgraph ID)
  • Support for pagination via first/skip parameters

Storage Backends

  • File: JSON Lines format for local development (one file per subgraph)
  • Elasticsearch: Enterprise search and analytics for production
  • Loki: Grafana's lightweight log aggregation system
  • Disabled: Default mode with no log storage overhead

Architecture

  • LogDrain: Sink for writing logs to storage backends (File, Loki, Elasticsearch)
  • LogStore: Read interface for querying logs from backends
  • LoggerFactory: Refactored to support multi-backend log routing
  • Configuration: Unified GRAPH_LOG_STORE_* environment variables with CLI argument parity

Examples

Querying logs

{
  _logs(
    level: ERROR
    search: "timeout"
    from: "2024-01-15T00:00:00Z"
    to: "2024-01-16T00:00:00Z"
    first: 100
  ) {
    id
    timestamp
    level
    text
    arguments {
      key
      value
    }
    meta {
      module
      line
      column
    }
  }
}

Configuring the logs store backend

File-based (development):

GRAPH_LOG_STORE_TYPE=file \
GRAPH_LOG_STORE_FILE_DIRECTORY=/var/log/subgraphs \
cargo run -p graph-node

Loki (production):

GRAPH_LOG_STORE_TYPE=loki \
GRAPH_LOG_STORE_LOKI_ENDPOINT=http://loki:3100 \
cargo run -p graph-node

@fordN fordN requested a review from dwerner January 15, 2026 18:20
@fordN fordN self-assigned this Jan 15, 2026
@fordN fordN added enhancement New feature or request area/graphql logs labels Jan 15, 2026
@fordN fordN removed the request for review from dwerner January 15, 2026 21:58
@fordN fordN force-pushed the ford/subgraph-logs-via-graphql branch from 688827a to 120d61b Compare January 16, 2026 00:10
@fordN fordN requested a review from dwerner January 16, 2026 00:12
fordN added 10 commits January 15, 2026 17:02
Introduces the foundation for the log store system with:
- LogStore trait for querying logs from backends
- LogLevel enum with FromStr trait implementation
- LogEntry and LogQuery types for structured log data
- LogStoreFactory for creating backend instances
- NoOpLogStore as default (disabled) implementation
Implements three log storage backends for querying logs:

- FileLogStore: Streams JSON Lines files with bounded memory usage
- ElasticsearchLogStore: Queries Elasticsearch indices with full-text search
- LokiLogStore: Queries Grafana Loki using LogQL

All backends implement the LogStore trait and support:
- Filtering by log level, timestamp range, and text search
- Pagination via first/skip parameters
- Returning structured LogEntry objects

Dependencies added: reqwest, serde_json for HTTP clients.
Implements slog drains for capturing and writing logs:

- FileDrain: Writes logs to JSON Lines files (one file per subgraph)
- LokiDrain: Writes logs to Grafana Loki via HTTP push API

Both drains:
- Capture structured log entries with metadata (module, line, column)
- Format logs with timestamp, level, text, and arguments
- Use efficient serialization with custom KVSerializers
Adds a configuration layer for selecting and configuring log backends:

- LogStoreConfig enum with variants: Disabled, File, Elasticsearch, Loki
- LogConfigProvider for loading config from environment variables and CLI args
- Unified GRAPH_LOG_STORE_* environment variable naming
- CLI arguments with --log-store-backend and backend-specific options
- Configuration precedence: CLI args > env vars > defaults
- Deprecation warnings for old config variables

Supported configuration:
- Backend selection (disabled, file, elasticsearch, loki)
- File: directory, max size, retention days
- Elasticsearch: endpoint, credentials, index, timeout
- Loki: endpoint, tenant ID
Refactors LoggerFactory to use LogStoreConfig instead of elastic-only:

- Replaced elastic_config with log_store_config parameter
- Build ElasticLoggingConfig on-demand from LogStoreConfig::Elasticsearch
- Support all log drain types (File, Loki, Elasticsearch)
- Maintain backward compatibility with existing elastic configuration

This enables the factory to create drains for any configured backend
while preserving the existing component logger patterns.
Adds GraphQL API for querying subgraph logs:

Schema types:
- LogLevel enum (CRITICAL, ERROR, WARNING, INFO, DEBUG)
- _Log_ type with id, timestamp, level, text, arguments, meta
- _LogArgument_ type for structured key-value pairs
- _LogMeta_ type for source location (module, line, column)

Query field (_logs) with filters:
- level: Filter by log level
- from/to: Timestamp range (ISO 8601)
- search: Text search in log messages
- first/skip: Pagination (max 1000, skip max 10000)
Integrates _logs query into the GraphQL execution pipeline:

Execution layer:
- Execute _logs queries via log_store.query_logs()
- Convert LogEntry results to GraphQL response objects
- Handle log store errors gracefully

Query parsing:
- Recognize _logs as special query field
- Build LogQuery from GraphQL arguments
- Pass log_store to execution context

Service wiring:
- Create log store from configuration in launcher
- Provide log store to GraphQL runner
- Use NoOpLogStore in test environments

This completes the read path from GraphQL query to log storage backend.
Adds comprehensive integration test for _logs query:

Test implementation:
- Deploys logs-query subgraph and waits for sync
- Triggers contract events to generate logs
- Queries _logs field with various filters
- Verifies log entries are returned correctly
- Tests filtering by level and text search
@fordN fordN force-pushed the ford/subgraph-logs-via-graphql branch from 120d61b to ee0f228 Compare January 16, 2026 01:31
- Create graph/src/log/common.rs for common log drain functionality
   - SimpleKVSerializer: Concatenates KV pairs to strings
   - VecKVSerializer: Collects KV pairs into Vec<(String, String)>
   - HashMapKVSerializer: Collects KV pairs into HashMap
   - LogMeta: Shared metadata structure (module, line, column)
   - LogEntryBuilder: Builder for common log entry fields
   - level_to_str(): Converts slog::Level to string
   - create_async_logger(): Consistent async logger creation
- Updated FileDrain, LokiDrain, and ElasticDrain to use the log common
utilities
@fordN fordN requested review from lutter and removed request for lutter January 16, 2026 02:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants