The Playground is a command-line utility built to validate your filters and rules inside an isolated environment, so production stays untouched. It lets you replay simulated log ingestion and watch how logs get transformed and which alerts fire.

🚀** Initialization**

To start using the playground, you must configure the environment variable:

• WORK_DIR: The location of your playground directory. All configuration, logs, and plugins will be stored in this folder.

Warning: Do not set WORK_DIR to /workdir, since that is the standard production path, and the playground will not start in order to avoid any accidental corruption of data.

# Example: Setting environment variable and initializing
export WORK_DIR=$(pwd)/playground_data
./playground -init

This will create the following structure:

• input/: Where you place your raw log files for testing (log.json).

• output/: Where results are saved (e.g., via sew or saw plugins).

• pipeline/filters/: Put your filter YAML files in this directory.

• rules/: Put your YAML files for analysis and correlation rules in this directory.

• plugins/: This is where the plugin binaries are stored.

• geolocation/: Databases from MaxMind/GeoIP used for enrichment.

• pipeline/config.yaml: Primary configuration for the engine.

🛠️** How to Use It**

1. Prepare the Input Logs

Place one or more JSON log files in the input/ directory. Every file should hold one log, formatted as JSON that works with the plugins.Log struct.

Example input/log.json:

{
  "dataType": "syslog",
  "dataSource": "my-server",
  "tenantId": "ce66672c-e36d-4761-a8c8-90058fee1a24",
  "raw": "<34>Jan 16 20:01:17 my-hostname sshd[1234]: Failed password for invalid user admin from 192.168.1.100 port 54321 ssh2"
}

2. Define Filters and Rules

Put your YAML files into the corresponding folders. These will be loaded by the playground when it starts.

3. Run the Test

Once your logs and configurations are ready, run the playground:

./playground

The tool will:

1. Bring up an internal Engine gRPC server.

2. Initialize and start all plugins found in plugins/.

3. Bring up a Worker Manager for data processing.

4. Read and enqueue all files from input/.

5. Let processing finish, then shut down gracefully.

🔍** Inspecting Results**

The playground is pre-configured (in config.yaml) to use the following plugins for output by default:

• sew (Simple Event Writer): Saves parsed events to output/resulting_log.json.

• saw (Simple Alert Writer): Saves generated alerts to output/resulting_alert.json.

Should no results appear, review the console output for problems with your YAML logic or CEL expressions.

💡** Tips**

• Restart Required: All configurations are loaded by the playground at startup. Any change to a filter or rule means you have to restart the process.

• Fetching Real Data: Use the opensearch-fetcher to retrieve actual logs from your production environment and use them as test cases within the playground.