Post Incident Analysis and Improvement Questions

import re
from datetime import datetime, timezone, timedelta
import dateutil.parser as dp

# common regexes
TS_USER_RE = re.compile(r'^\[(?P<ts>[\d\-:\sT]+)\]\s+(?P<user>\S+):\s+(?P<msg>.+)$')
ALERT_RE = re.compile(r'^(?P<ts>\d{1,2}:\d{2}:\d{2})?\s*(?P<level>ALERT|WARN|ERROR)\s+(?P<service>[\w\-]+)\s+(?P<metric>.+)$')
DEPLOY_RE = re.compile(r'deployed\s+(?P<service>[\w\-]+)\s+version=(?P<ver>[\d\.]+)', re.I)

def parse_line(line, default_tz=timezone.utc, channel_date=None):
    line = line.strip()
    m = TS_USER_RE.match(line)
    if m:
        ts_raw = m.group('ts')
        try:
            ts = dp.parse(ts_raw)
        except Exception:
            ts = None
        user = m.group('user')
        msg = m.group('msg')
    else:
        m2 = ALERT_RE.match(line)
        if m2:
            ts_raw = m2.group('ts')
            ts = None
            if ts_raw and channel_date:
                # combine time-only with channel day
                ts = dp.parse(f"{channel_date} {ts_raw}")
            user = None
            msg = line
        else:
            ts = None; user = None; msg = line

    # NLP heuristics: extract service, versions, metrics
    service = None; version = None; metric = None
    d = DEPLOY_RE.search(msg)
    if d:
        service = d.group('service'); version = d.group('ver')
    # metric heur: look for p95/p99 or "latency 400ms"
    mlat = re.search(r'(?P<metric_name>p\d+|latency)\s+(?P<value>[\d\.]+ms|\d+ms|\d+)', msg, re.I)
    if mlat:
        metric = {'name': mlat.group('metric_name'), 'value': mlat.group('value')}

    return {'raw': line, 'ts': ts, 'user': user, 'service': service, 'version': version, 'metric': metric, 'msg': msg}