Lava v2.0.2 - Syslog Support + Bug Fixes

New

• Syslog Timestamp Support
  Added support for timestamps that do not include a year (e.g., syslog entries). Since chrono::NaiveDateTime in Rust requires a year component, LAVA now uses the append_1970_to_the_left function to prepend 1970 as the default year for such timestamps. To support this behavior, the should_match schema was updated to include the expected data in ISO 8601 format. An example is provided below

- pretty_format: "Mon D HH:MM:SS"
  regex: "\\b[A-Za-z]{3} \\d{1,2} \\d{2}:\\d{2}:\\d{2}\\b"
  strftime_format: "%Y %b %e %H:%M:%S"
  function_to_call: "append_1970_to_the_left"
  should_match:
    - "Jan 01 01:00:00==1970-01-01T01:00:00Z"
    - "Jan 1 01:00:00==1970-01-01T01:00:00Z"
    - "Dec 31 23:59:59==1970-12-31T23:59:59Z"
    - "Aug 14 00:02:05 ra-syslog systemd[1]: logrotate.service: Succeeded.==1970-08-14T00:02:05Z"
    - "Nov 4 08:39:59==1970-11-04T08:39:59Z"
  should_not_match:
    - "Jan 01 2023 00:01:00==2023-01-01T01:00:00Z"

Bug Fixes

• Manually enable ANSI so that colors will show in all command prompts

Lava v2.0.1 - Mutate Functions + Bug Fixes

New

• Mutate Functions
  Added an optional parameter in the dates.yml file, function_to_call, that can be used to mutate the string captured by the regex, before it is parsed with the stftime string. This is necessary for some time formats like Epoch milliseconds and Syslog events with no year. Basically any format where the timestamp string on it's own, does not have a valid rust strftime format to parse it. As such you need something to mutate the string so that it can parse properly. The string in the dates.yml file needs to reference a function in date_string_mutations.rs

 -pretty_format: "Epoch Time Milliseconds"
  regex: "\\b\\d{13}\\b"
  strftime_format: "%s"  # Note: %s is platform-dependent
  function_to_call: "strip_to_10_most_significant_digits"
  should_match:
    - "1672534800000"
    - "date:1672534800000"
    - "\\\"ts\\\":1672534800000.000000"
  should_not_match:
    - "1672534800"
    - "date:1672534800"
    - "\\\"ts\\\":1672534800.000000"

Bug Fixes

• Fixed csv header row identification issue.
• Fixed overlapping files alert issue where it would be printed multiple times.

LAVA v2.0.0 - Multipart Mode

New

• Multipart Mode
  Added an option to treat all input files as if they’re part of a single continuous log. Useful when logs are split across multiple files but should be analyzed as one. If the largest time gap occurs between files, it will now be included in the calculation, and alerts will be regenerated accordingly.

Improvements

• Small quality-of-life tweaks across the CLI and output formatting.
• Error messages in a few places are clearer.

Updates

• Added more redaction patterns to cover sensitive fields.
• Expanded timestamp regex support to handle additional log formats.

Lava v1.0.0

v1.0.0-2025_07_20_22_59_53

Add timestamp format