doganulus/montre

Montre is a command-line tool that searches for patterns in streams of events that happen over time. Think of it like a search function, but instead of looking for keywords in text, it finds sequences of things that occur within specific time windows. For example, you could use it to detect when a soccer player sprints (runs fast for a short burst), or to identify suspicious behavior patterns in system logs, anything where the timing between events matters as much as which events occur. The tool works by letting you write a "timed regular expression", a compact pattern description that combines conditions and timing rules. You can specify that something must happen, then something else must happen within the next 3 to 4 seconds, for instance. You can also say "this must not happen," or "repeat this pattern at least once," or combine multiple conditions with AND and OR logic. Once you've written your pattern, you give Montre a file of timestamped events and it finds all the matches, either processing the whole file at once (batch mode) or streaming in new events as they arrive (online mode). Researchers and engineers working on monitoring and verification would be the primary users, people who need to detect specific behavior patterns in sensor data, logs, network traffic, or other time-series event streams. The tool comes from academic research on formal methods, so it's particularly useful if you need mathematically rigorous pattern matching with timing guarantees. Installation requires some dependencies (GNU tools and a few libraries), but the README also offers a Docker option if you want to avoid setting up the environment manually.