Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

Log field, metric, action and event names now say what they count
and, for timings, the unit. Package internal/waf is internal/coreruleset.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -42,9 +42,9 @@ const (
 	// block rule.
 	ActionBlockedByBlockRule = "blocked_by_block_rule"
 
-	// ActionWAFBlocked is a request refused because the Core Rule Set
-	// scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
-	ActionWAFBlocked = "waf_blocked"
+	// ActionBlockedByCoreRuleSet is a request refused because the Core Rule
+	// Set scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
+	ActionBlockedByCoreRuleSet = "blocked_by_core_rule_set"
 
 	// ActionClientDenied is a request refused because its client is in
 	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
@@ -55,9 +55,9 @@ const (
 	// ActionCountryDenied is a request refused because its client's country
 	// is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
 	ActionCountryDenied = "country_denied"
-	// ActionAdmin is a request discriminator answered at one of its own
+	// ActionOwnEndpoint is a request discriminator answered at one of its own
 	// endpoints, or a question about a path under /_sww/.
-	ActionAdmin = "admin"
+	ActionOwnEndpoint = "own_endpoint"
 )
 
 // OffenceLimit is the offence a request line names for a request that
@@ -65,9 +65,9 @@ const (
 // limit.
 const OffenceLimit = "limit"
 
-// LimitHitErrorBurst is the limit_hit a request line names for a request
+// LimitHitMinuteRefusals is the limit_hit a request line names for a request
 // that broke the error burst.
-const LimitHitErrorBurst = "error_burst"
+const LimitHitMinuteRefusals = "minute_refusals"
 
 // The discriminator_line a request line names, which says which of
 // discriminator's two lines about a question it is.
@@ -141,8 +141,9 @@ type Line struct {
 	// WouldAction is, in observe mode, the action enforce mode would have
 	// taken with a request it would have refused: ActionClientDenied,
 	// ActionTemporarilyBanned, ActionPermanentlyBanned, ActionCountryDenied,
-	// ActionClientIsRateLimited, ActionBlockedByBlockRule, ActionWAFBlocked,
-	// or, in discriminator, ActionRequestHeaderTooLarge for the header limits.
+	// ActionClientIsRateLimited, ActionBlockedByBlockRule,
+	// ActionBlockedByCoreRuleSet, or, in discriminator,
+	// ActionRequestHeaderTooLarge for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// Heuristic is the name of the heuristic that refused the request, in
 	// observe mode too, and HeuristicFigures are the figures it acted on, by
@@ -154,15 +155,15 @@ type Line struct {
 	// request.
 	AfterAnswerHeuristic        string         `json:"after_answer_heuristic,omitempty"`
 	AfterAnswerHeuristicFigures map[string]any `json:"after_answer_heuristic_figures,omitempty"` //nolint:lll // a struct tag cannot be split
-	// LimitPercent and LimitPercentSetting are, for a request the rate
-	// limits counted whose client a biased threshold gives a percentage of
-	// the rate limits below 100, that percentage and the setting that gave
-	// it. BytesPercent and BytesPercentSetting are the same for the byte
-	// limits.
-	LimitPercent        *int64 `json:"limit_percent,omitempty"`
-	LimitPercentSetting string `json:"limit_percent_setting,omitempty"`
-	BytesPercent        *int64 `json:"bytes_percent,omitempty"`
-	BytesPercentSetting string `json:"bytes_percent_setting,omitempty"`
+	// RateLimitPercent and RateLimitPercentSetting are, for a request the
+	// rate limits counted whose client a biased threshold gives a percentage
+	// of the rate limits below 100, that percentage and the setting that gave
+	// it. BytesLimitPercent and BytesLimitPercentSetting are the same for the
+	// byte limits.
+	RateLimitPercent         *int64 `json:"rate_limit_percent,omitempty"`
+	RateLimitPercentSetting  string `json:"rate_limit_percent_setting,omitempty"`
+	BytesLimitPercent        *int64 `json:"bytes_limit_percent,omitempty"`
+	BytesLimitPercentSetting string `json:"bytes_limit_percent_setting,omitempty"`
 	// Counts are, for a request the rate limits counted, the client's
 	// requests as they counted them with this one, and its bytes as the
 	// byte limits counted them, with this request's once it has ended if
@@ -170,15 +171,15 @@ type Line struct {
 	Counts ratelimit.Counts `json:"counts,omitzero"`
 	// RuleIDs are the ids of the rule file rules the request matched.
 	RuleIDs []string `json:"rule_ids,omitempty"`
-	// WAFRuleIDs are the ids of the Core Rule Set's rules the request
-	// matched, and WAFScore its anomaly score, nil for a request the Core
-	// Rule Set did not inspect.
-	WAFRuleIDs []int `json:"waf_rule_ids,omitempty"`
-	WAFScore   *int  `json:"waf_score,omitempty"`
+	// CoreRuleSetRuleIDs are the ids of the Core Rule Set's rules the request
+	// matched, and CoreRuleSetScore its anomaly score, nil for a request the
+	// Core Rule Set did not inspect.
+	CoreRuleSetRuleIDs []int `json:"core_rule_set_rule_ids,omitempty"`
+	CoreRuleSetScore   *int  `json:"core_rule_set_score,omitempty"`
 	// LimitHit is the window whose limit the request went over, named as
 	// Counts names its count: minute, hour or day for a rate limit, and
 	// minute_bytes, hour_bytes or day_bytes for a byte limit; or
-	// LimitHitErrorBurst for the error burst.
+	// LimitHitMinuteRefusals for the error burst.
 	LimitHit string `json:"limit_hit,omitempty"`
 	// Reputation are the URLs of the blocklists that list the client, then
 	// that of the CrowdSec decision list when it does, then the DNSBL zones
@@ -197,15 +198,15 @@ type Line struct {
 	// ends: a time, or "permanent".
 	BanExpires string `json:"ban_expires,omitempty"`
 
-	// The timings, in milliseconds. DurationChecks is the time until the
-	// checks were done, and DurationWAF the part of it the Core Rule Set
-	// took. DurationUpstreamTotal is what the report of an allowed request gives,
+	// The timings. DurationChecksMS is the time until the checks were done, and
+	// DurationCoreRuleSetMS the part of it the Core Rule Set took.
+	// DurationUpstreamTotalMS is what the report of an allowed request gives,
 	// from the hand-over to the app until the end of its answer. Each but
-	// DurationTotal is nil for a request that did not get that far.
-	DurationTotal         float64  `json:"duration_total"`
-	DurationChecks        *float64 `json:"duration_checks,omitempty"`
-	DurationWAF           *float64 `json:"duration_waf,omitempty"`
-	DurationUpstreamTotal *float64 `json:"duration_upstream_total,omitempty"`
+	// DurationTotalMS is nil for a request that did not get that far.
+	DurationTotalMS         float64  `json:"duration_total_ms"`
+	DurationChecksMS        *float64 `json:"duration_checks_ms,omitempty"`
+	DurationCoreRuleSetMS   *float64 `json:"duration_core_rule_set_ms,omitempty"`
+	DurationUpstreamTotalMS *float64 `json:"duration_upstream_total_ms,omitempty"`
 }
 
 // RProxyLine is rproxy's short line in the request log about one request. The
@@ -225,11 +226,11 @@ type RProxyLine struct {
 	Status        int    `json:"status"`
 	RequestBytes  int64  `json:"request_bytes"`
 	ResponseBytes int64  `json:"response_bytes"`
-	// DurationRequest runs in milliseconds from the request's headers being read
-	// until the app has been sent the whole request, or the answer has started
-	// if that is sooner. DurationResponse runs from then until the answer ends.
-	DurationRequest  float64 `json:"duration_request"`
-	DurationResponse float64 `json:"duration_response"`
+	// DurationRequestMS runs from the request's headers being read until the app
+	// has been sent the whole request, or the answer has started if that is
+	// sooner. DurationResponseMS runs from then until the answer ends.
+	DurationRequestMS  float64 `json:"duration_request_ms"`
+	DurationResponseMS float64 `json:"duration_response_ms"`
 	// Disposition is the valid disposition discriminator answered or, while
 	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.

internal/requestlog/requestlog_test.go

@@ -18,11 +18,11 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	var out bytes.Buffer
 
 	err := requestlog.Write(&out, &requestlog.Line{
-		Time:          requestlog.FormatTime(time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)),
-		ClientIP:      "203.0.113.9",
-		Status:        200,
-		Action:        requestlog.ActionForward,
-		DurationTotal: requestlog.Milliseconds(1500 * time.Microsecond),
+		Time:            requestlog.FormatTime(time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)),
+		ClientIP:        "203.0.113.9",
+		Status:          200,
+		Action:          requestlog.ActionForward,
+		DurationTotalMS: requestlog.Milliseconds(1500 * time.Microsecond),
 	})
 	if err != nil {
 		t.Fatalf("write: %v", err)
@@ -43,7 +43,7 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	want := map[string]any{
 		"type": "request", "time": "2026-10-03T12:00:00.000Z",
 		"client_ip": "203.0.113.9", "status": 200.0, "action": "forward",
-		"duration_total": 1.5,
+		"duration_total_ms": 1.5,
 	}
 	for name, value := range want {
 		if fields[name] != value {
@@ -55,9 +55,9 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 		"forwarded_for", "content_type", "content_length", "request_headers",
 		"has_authorization", "has_cookie", "websocket", "response_content_type",
 		"upstream_status", "cache_control", "location", "aborted", "counts",
-		"limit_hit", "offence", "ban_expires", "duration_checks",
+		"limit_hit", "offence", "ban_expires", "duration_checks_ms",
 		"duration_upstream_connect", "duration_upstream_first_byte",
-		"duration_upstream_total",
+		"duration_upstream_total_ms",
 	}
 	for _, name := range unset {
 		_, present := fields[name]
@@ -82,7 +82,7 @@ func TestWriteRProxyLineWritesOneJSONLineWithOnlyItsFields(t *testing.T) {
 
 	const want = `{"type":"request","time":"","request_id":"an-id","client_ip":"",` +
 		`"host":"","method":"","path":"","query":"","status":0,"request_bytes":0,` +
-		`"response_bytes":0,"duration_request":0,"duration_response":0,` +
+		`"response_bytes":0,"duration_request_ms":0,"duration_response_ms":0,` +
 		`"disposition":"allow"}` + "\n"
 	if out.String() != want {
 		t.Errorf("wrote %s, want %s", out.String(), want)