Getting Started

BlazeRules runs YAML rules over event batches. Start by choosing how records enter the engine.

Choose An Input Path

Input	Use	Next page
NDJSON bytes or JSON logs	`RuleEngine.evaluate_ndjson(...)` or `blazerules eval --input ndjson`	Quickstart
A top-level JSON array batch	`RuleEngine.evaluate_json_array(...)` or `blazerules eval --input json-array`	Python API
PyArrow / Arrow batches	`RuleEngine.evaluate_batch(...)`	Python API
Application logs over HTTP	`blazerules_agent --input http`	HTTP Logs
Terminal, stdout, stderr, or service logs	`blazerules_agent --input stdin`	stdin Logs
A log file to follow	`blazerules_agent --input file_tail`	File Tail
Kubernetes pod logs	Helm chart / DaemonSet	Kubernetes Logs
Kafka topics	`blazerules stream kafka`, or `blazerules_io` Kafka loop	Kafka Streaming
Arrow IPC, Avro, or Protobuf	`blazerules eval --input arrow-ipc\|avro\|protobuf`, or `blazerules_io` decoders	Binary Formats
S3 or local files	`blazerules_io.read_*`	S3 Resources

All of these paths end at the same batch engine. The input adapter changes; rule semantics do not.

Install

pip install blazerules
python -c "import blazerules, blazerules_io; print(blazerules.__version__, blazerules.simd_backend())"

The wheel also installs three command-line executables on the active PATH: blazerules (batch and stream operations), blazerules_agent, and blazerules_dashboard. Verify the installation with blazerules info.

Minimal Rule

schema_version: "2.1"
ruleset:
  name: app-log-rules
  version: "1.0.0"
  rules:
    - id: error_payment
      action: REVIEW
      conditions:
        and:
          - field: level
            op: eq
            value: error
          - field: message
            op: contains
            value: payment

Save it as rules.yaml.

Evaluate NDJSON In Python

import blazerules

engine = blazerules.RuleEngine()
engine.load_rules("rules.yaml")

payload = b"""
{"event_id":"e1","level":"info","message":"checkout started","amount":30}
{"event_id":"e2","level":"error","message":"payment failed","amount":900}
"""

result = engine.evaluate_ndjson(payload)
print(result.decisions)
print(result.match_counts)

CLI equivalent: `blazerules eval`

printf '%s\n' \
  '{"event_id":"e1","level":"info","message":"checkout started","amount":30}' \
  '{"event_id":"e2","level":"error","message":"payment failed","amount":900}' | \
  blazerules eval --rules rules.yaml --input ndjson --stdin --output decisions-jsonl

Agent equivalent: evaluate through the local agent

printf '%s\n' \
  '{"event_id":"e1","level":"info","message":"checkout started","amount":30}' \
  '{"event_id":"e2","level":"error","message":"payment failed","amount":900}' | \
  blazerules_agent --rules rules.yaml --input stdin --output stdout

Run A Local HTTP Ingest Endpoint

blazerules_agent \
  --rules rules.yaml \
  --input http \
  --host 127.0.0.1 \
  --port 9480 \
  --batch-size 2048 \
  --flush-ms 100 \
  --output ndjson \
  --output-path decisions.ndjson

Send records:

curl -X POST http://127.0.0.1:9480/v1/logs \
  --data-binary $'{"event_id":"e2","level":"error","message":"payment failed","amount":900}\n'

Python equivalent: send the same HTTP batch

import urllib.request

payload = b'{"event_id":"e2","level":"error","message":"payment failed","amount":900}\n'
urllib.request.urlopen("http://127.0.0.1:9480/v1/logs", data=payload).read()

Inspect Decisions

blazerules_dashboard \
  --decision-log decisions.ndjson \
  --dead-letter-log dead_letters.ndjson \
  --rules rules.yaml

Open http://127.0.0.1:9470.

Where To Go Next

Ingestion Overview

Every supported input type and where it fits.

Quickstart

JSON and Arrow examples using the Python module.

HTTP Logs

POST NDJSON records to the local agent.

File Tail

Tail application, stdout, stderr, or pod log files.