fix(import): read a priority-less syslog line, widen detection, and name the file

[Wasabules]

Closes #50.

1. What was reported

After import of offline logs the importer adds prefix "example-01.invalid" in the message.

It adds nothing. The reporter's file is what rsyslog writes to disk by default — RFC 3164 without a priority, because the priority only exists on the wire:

Sep 18 08:05:13 nbb-ad-01.vms.nbb.nod Microsoft-Windows-Security-Auditing[756]: An account was logged on

Run through the importer as it shipped:

hostname="" app="" proc=""
message="nbb-ad-01.vms.nbb.nod Microsoft-Windows-Security-Auditing[756]: An account was logged on"

The timestamp was read and everything after it was treated as free text: the Hostname and App columns stayed empty, and the hostname sat at the front of the message, where anonymous mode correctly rewrote it to a stand-in. What looked like an invented prefix was the reporter's own host.

Now HOST TAG[PID]: MSG is read out of what follows a timestamp, with the tag coming off through the wire parser's own extractor rather than a second definition of what a tag is. The year and zone stay the format panel's. In syslog mode a priority-less line used to be treated as the tail of the one above it, folding a whole rsyslog file into a handful of messages.

The first token is the only judgement call and it is guarded — a severity word is never a hostname, and the tag must be a real something: token. Six lines that must keep their message intact are pinned, including 21:42:40 WARN queue: depth 812.

2. Detection, widened

Fixing that showed how much else was missed. Automatic detection is now a chain, from the formats that announce themselves to the ones that must be inferred; every branch before the last is anchored and specific, so a line reaches the general detector only when nothing recognised it outright.

Added	Why detection could not reach it
Kubernetes klog	the level is a letter glued to the date
Android logcat, both forms	integers between the timestamp and the level; or no timestamp at all
Apache error log	bracketed header, year last
Squid and friends	an epoch and nothing else
access logs	the timestamp is in the middle of the line
JSON, logfmt	the fields are not where detection looks
Go, nginx	slash dates
zap, Serilog	numeric zone, zone after a space
Ruby, Rails	a letter and a comma before the bracket
INF WRN DBG VRB FTL	three-letter level spellings

3. The file is now named, and the dialog says so

Reported after the above: an Apache access log imports correctly, "Access log" sits in the format list, and nothing says that is what the file is.

Every branch now reports what it recognised, the shapes are counted per file, and the file is named from them:

• a clear majority names the file, not a plurality. Half access lines and half something else is mixed, because announcing an access log there would be a confident answer to a question that has none;
• when the named shape has a format of its own, the selector switches to it and says it chose it — only from automatic, and only once, since a format chosen by hand is a decision and overruling it would be the application arguing with the operator;
• the sample is then read again through that format, so what is on screen is what the chosen mode produces.

Verified

Lines — TestAuto_Corpus: 27 lines, one per format, taken from what each tool really writes. Four of them must stay unrecognised: a sentence with a colon, a level word followed by a colon, a stack-trace line, a line with no shape. A wide recogniser earns its width only by staying silent on what it does not understand — an invented hostname is worse than an unparsed line, because the text still shows while the field quietly lies.

Files — TestSampleFiles: all thirteen files in tools/sample-logs/, checked for the message count, the verdict, the matching mode and the fields of the first message.

access.txt               n=7   detected=access  mode=access   [access=7]
apache-error.txt         n=5   detected=apache  mode=         [apache=5]
archive-2019.txt         n=6   detected=bsd     mode=syslog   [bsd=6]
auto-formats.txt         n=23  detected=mixed   mode=         [access=1 apache=1 bsd=3 epoch=1
                                                               json=2 klog=1 logcat=1 logfmt=1
                                                               plain=10 syslog=2]
json-lines.txt           n=8   detected=json    mode=json     [json=8]
klog.txt                 n=6   detected=klog    mode=         [klog=6]
logcat.txt               n=9   detected=logcat  mode=         [logcat=9]
logfmt.txt               n=7   detected=logfmt  mode=logfmt   [logfmt=7]
messy.txt                n=8   detected=mixed   mode=         [bsd=1 json=1 none=4 plain=2]
nginx-error.txt          n=5   detected=plain   mode=         [plain=5]
plain-app.txt            n=9   detected=plain   mode=         [plain=9]
rsyslog-traditional.txt  n=6   detected=bsd     mode=syslog   [bsd=6]
syslog-capture.txt       n=8   detected=syslog  mode=syslog   [syslog=8]

A file with no expectation fails that test, so adding a sample means making a claim about it. A second test declares each file's detected mode and checks nothing is lost by it: the dialog offers that switch, and an operator who takes it must not get a worse result for agreeing with us.

That corpus already earned its keep — it is what caught that logcat.txt used the brief form, which nothing recognised, while the README claimed a custom pattern was needed for it. The brief form is recognised now.

go test ./..., go vet, gofmt, svelte-check --fail-on-warnings, the frontend build and the site's link check are clean. Strings added across all 8 locales (471 keys × 8, parity checked).

Not in this PR

That nothing on screen said the display was anonymised is #49, in #52.