log schema contract audit derived

{
  "input": {
    "body": {
      "logs": "{\"timestamp\":\"2026-10-02T12:00:00.000Z\",\"level\":\"info\",\"message\":\"request completed\",\"status\":200,\"duration_ms\":12}\n{\"timestamp\":\"2026-10-02T12:00:01.000Z\",\"level\":\"ERROR\",\"message\":\"request failed for order 8827341 after 3 retries\",\"status\":500,\"duration_ms\":\"940\"}\n{\"timestamp\":\"2026-10-02T12:00:02.000Z\",\"level\":\"info\",\"message\":\"request failed for order 8827342 after 1 retries\",\"status\":500,\"duration_ms\":880}\n{\"timestamp\":\"2026-10-02 12:00:03.000\",\"level\":\"warn\",\"message\":\"request failed for order 8827343 after 2 retries\",\"status\":503}\n{\"timestamp\":\"2026-10-02T12:00:04.000Z\",\"level\":\"info\",\"message\":\"request failed for order 8827344 after 1 retries\",\"status\":500,\"duration_ms\":790}\n{\"level\":\"info\",\"message\":\"request failed for order 8827345 after 4 retries\",\"status\":500,\"duration_ms\":1200}\n{\"timestamp\":\"2026-10-02T12:00:06.000Z\",\"level\":\"info\",\"message\":\"request failed for order 8827346 after 2 retries\",\"status\":500,\"duration_ms\":810}\n{\"timestamp\":\"2026-10-02T12:00:07.000Z\",\"level\":\"info\",\"message\":\"request failed for order 8827347 after 1 retries\",\"status\":500,\"duration_ms\":760}\n{\"timestamp\":\"2026-10-02T12:00:08.000Z\",\"level\":\"info\",\"message\":\"request failed for order 8827348 after 3 retries\",\"status\":500,\"duration_ms\":920}\n{\"timestamp\":\"2026-10-02T12:00:09.000Z\",\"level\":\"info\",\"message\":\"request failed for order 8827349 after 1 retries\",\"status\":500,\"duration_ms\":700}\n{not json at all",
      "contract": {
        "field_types": {
          "status": "number",
          "duration_ms": "number"
        },
        "required_fields": [
          "timestamp",
          "level",
          "message",
          "service"
        ],
        "permitted_levels": [
          "debug",
          "info",
          "warn",
          "error"
        ],
        "require_timestamp_offset": true
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "fields": [
        {
          "field": "timestamp",
          "types": {
            "string": 9
          }
        },
        {
          "field": "level",
          "types": {
            "string": 10
          }
        },
        {
          "field": "message",
          "types": {
            "string": 10
          }
        }
      ],
      "limits": {
        "maxLines": 20000,
        "maxSpans": 10000,
        "maxFields": 500,
        "maxSamples": 20000,
        "maxFindings": 500,
        "maxJsonBytes": 2097152
      },
      "passed": false,
      "checked": {
        "field_types": 2,
        "required_fields": 4,
        "permitted_levels": 4,
        "timestamp_offset": true
      },
      "complete": true,
      "findings": [
        {
          "code": "LINE_NOT_VALID_JSON",
          "line": 11,
          "detail": "Line 11 is not valid JSON: Expected property name or '}' in JSON at position 1 (line 1 column 2). Whatever ships this line is dropped by the collector."
        },
        {
          "code": "REQUIRED_FIELD_ABSENT",
          "line": 1,
          "field": "service",
          "detail": "Line 1 is missing service, so whatever filters on it drops this line."
        },
        {
          "code": "REQUIRED_FIELD_ABSENT",
          "line": 2,
          "field": "service",
          "detail": "Line 2 is missing service, so whatever filters on it drops this line."
        }
      ],
      "conformant": false,
      "line_count": 10,
      "request_id": "example-request",
      "service_id": "log_schema_contract_audit",
      "assumptions": [
        "No log value is ever returned, only field names, types and counts. A log line is the one place a credential or a customer record is most likely to be, so echoing values back would be the problem rathe...",
        "A field whose type varies between lines is reported because it is only visible across the whole set, and because an index either rejects the minority or coerces them without saying so.",
        "A message field with nearly as many distinct values as lines is reported as interpolated rather than templated: the message is the grouping key, so cost then scales with volume instead of with distinc..."
      ],
      "field_count": 5,
      "limitations": [
        "The lines supplied against the contract supplied. What a particular backend does with them, and whether the values are true, are outside this.",
        "conformant is true only when every line parsed and every check that ran found nothing."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 18,
      "service_version": "1.0.0",
      "findings_by_code": {
        "TIMESTAMP_ABSENT": 1,
        "LEVEL_CASE_DIFFERS": 1,
        "FIELD_TYPE_MISMATCH": 1,
        "LINE_NOT_VALID_JSON": 1,
        "REQUIRED_FIELD_ABSENT": 11,
        "TIMESTAMP_WITHOUT_OFFSET": 1,
        "FIELD_TYPE_VARIES_BETWEEN_LINES": 1,
        "MESSAGE_IS_INTERPOLATED_NOT_TEMPLATED": 1
      },
      "with_timestamp_count": 9,
      "distinct_message_count": 10
    }
  }
}