Loq 0.1.64

Loq

Modern .NET API for loq — a cross-platform reimplementation of Microsoft Log Parser 2.2 in Rust.

If you want a drop-in replacement for the classic MSUtil.LogQuery COM interface, use Loq.Classic instead. Loq is for new code that wants idiomatic .NET ergonomics: strongly-typed results, IEnumerable<T>, DataTable, and bulk JSON transfer for performance.

Install

dotnet add package Loq

The package transitively pulls in Loq.Native, which ships native binaries for win-x64 and linux-x64.

Quick start

using Loq;

// Strongly-typed results
public record Request(string c_ip, int sc_status, string cs_uri_stem);

foreach (var req in LogEngine.Query<Request>(
    @"SELECT c-ip, sc-status, cs-uri-stem
      FROM 'C:\logs\W3SVC1\*.log'
      WHERE sc-status >= 400"))
{
    Console.WriteLine($"{req.c_ip} → {req.sc_status} {req.cs_uri_stem}");
}

API surface

// Typed projection — properties are matched against output columns by name (case-insensitive).
IEnumerable<T> LogEngine.Query<T>(string sql)
IEnumerable<T> LogEngine.Query<T>(string sql, string? inputFormat = null, int maxRows = 0)

// Untyped — each row as a Dictionary<string, object?>.
IEnumerable<Dictionary<string, object?>> LogEngine.Query(string sql)
IEnumerable<Dictionary<string, object?>> LogEngine.Query(string sql, string? inputFormat = null, int maxRows = 0)

// Full result with metadata (column types, total row count).
QueryResult LogEngine.Execute(string sql)

// Count-only — skips materializing rows; faster for `SELECT COUNT(*)`-style queries.
long LogEngine.Count(string sql)

// Schema introspection without executing.
SchemaInfo LogEngine.GetSchema(string sql)

// One-line conversion to System.Data.DataTable.
DataTable LogEngine.ToDataTable(string sql)

SQL syntax

Same as MS Log Parser 2.2 — see the LP22 syntax reference for SELECT/FROM/WHERE/GROUP BY/ORDER BY/USING/INTO, the 100+ built-in functions (SUBSTR, QUANTIZE, EXTRACT_TOKEN, TO_TIMESTAMP, HASHMD5, etc.), and LP22 features like comma-separated multi-source FROM (FROM 'a','b','c'), wildcard FROM paths (case-insensitive on every platform), and INTO for file/chart output.

Supported input formats include CSV, TSV, W3C, IIS native + binary, NCSA / Apache / Nginx, JSON / NDJSON, XML, EVTX, REG, PCAP, syslog, fixed-width text, S3, Parquet, plus filesystem and ETW (Windows). Output formats include CSV, TSV, JSON, XML, W3C, IIS, DATAGRID, SQLite, SQL Server, MySQL / Aurora MySQL, PostgreSQL, ODBC (Windows), syslog, CloudWatch, NAT (native binary), Parquet, charts (PNG / SVG), and templates.

Aurora MySQL is wire-compatible with MySQL — connect via standard mysql://user:pass@aurora-writer-endpoint/db?ssl-mode=REQUIRED URL. See docs/output-formats/mysql.md for cluster-endpoint, TLS, and batch-sizing guidance.

Performance

Bulk JSON transfer between the .NET layer and the native engine — the native library does all of the parsing, filtering, grouping, and projection in Rust, then ships back a single JSON payload. For typical loq workloads (millions of log rows) this is significantly faster than row-by-row iteration through P/Invoke.

If you want streaming row-by-row for very large result sets, drop down to Loq.Classic's LogRecordSet cursor API.

Source / issues

• Source: https://github.com/chaynes81-ux/loq
• Releases & docs: https://chaynes81-ux.github.io/loq-releases/
• Issues: file at the GitHub repo above.

License

MIT.