Log Analyzer Skill

Parse and analyze log files for patterns, errors, trends, and statistics.

When to Use

✅ USE this skill when:

• "Analyze this log file"
• "Find errors in logs"
• "Extract patterns from logs"
• "Statistics from log file"
• "Count log entries by type"

When NOT to Use

❌ DON'T use this skill when:

• Real-time log streaming ΓåÆ use file-watcher + tail
• Structured data analysis ΓåÆ use json-yaml-query
• Log shipping ΓåÆ use log forwarders

Commands

Basic Analysis

{baseDir}/analyze.sh <logfile>
{baseDir}/analyze.sh /var/log/app.log
{baseDir}/analyze.sh app.log --summary

Error Analysis

{baseDir}/analyze.sh app.log --errors
{baseDir}/analyze.sh app.log --errors-only
{baseDir}/analyze.sh app.log --error-count
{baseDir}/analyze.sh app.log --error-pattern "Failed|Error|Exception"

Pattern Matching

{baseDir}/analyze.sh app.log --pattern "user: \d+"
{baseDir}/analyze.sh app.log --pattern "error|warning" --count
{baseDir}/analyze.sh app.log --pattern "Exception" --context 3

Time-based Analysis

{baseDir}/analyze.sh app.log --time-range "2024-01-01" "2024-01-02"
{baseDir}/analyze.sh app.log --last 1h
{baseDir}/analyze.sh app.log --last 24h
{baseDir}/analyze.sh app.log --hourly
{baseDir}/analyze.sh app.log --timeline

Log Formats

{baseDir}/analyze.sh access.log --format apache
{baseDir}/analyze.sh nginx.log --format nginx
{baseDir}/analyze.sh app.log --format json
{baseDir}/analyze.sh syslog --format syslog
{baseDir}/analyze.sh app.log --format custom --regex '\[(.*?)\] (\w+): (.*)'

Statistics

{baseDir}/analyze.sh app.log --stats
{baseDir}/analyze.sh app.log --count-by level
{baseDir}/analyze.sh app.log --count-by hour
{baseDir}/analyze.sh app.log --unique "ip"
{baseDir}/analyze.sh app.log --top 10 error

Options

Option	Description	Default
--summary	Show summary overview	false
--errors	Show error entries	false
--errors-only	Only show errors (hide others)	false
--error-pattern REGEX	Custom error pattern	built-in
--pattern REGEX	Search for pattern	None
--count	Count pattern matches	false
--context N	Show N lines of context	0
--time-range START END	Filter by time range	None
--last DURATION	Last N duration (e.g., 1h, 24h, 7d)	None
--hourly	Group by hour	false
--timeline	Show events timeline	false
--stats	Show statistics	false
--count-by FIELD	Count by field	None
--unique FIELD	Unique values in field	None
--top N FIELD	Top N values by field	None
--format FORMAT	Log format: apache, nginx, json, syslog, custom	auto-detect
--regex REGEX	Custom regex for format	None
--output FORMAT	Output format: text, json, csv	text

Log Formats

Apache Combined Log

127.0.0.1 - - [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326

Auto-detected. Use --format apache.

Nginx Log

127.0.0.1 - - [10/Oct/2000:13:55:36 +0000] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0"

Auto-detected. Use --format nginx.

JSON Log

{"timestamp": "2024-01-01T00:00:00Z", "level": "INFO", "message": "Started"}

Auto-detected. Use --format json.

Syslog

Jan  1 00:00:00 hostname process[pid]: message

Auto-detected. Use --format syslog.

Custom Format

Use --regex to define custom format with capture groups:

{baseDir}/analyze.sh app.log --format custom --regex '\[(.*?)\] (\w+): (.*)'

Output Examples

Summary

Log Analysis Summary: app.log
================================
Total lines:     10,000
Date range:     2024-01-01 to 2024-01-02
Log levels:     
  INFO:          8,500 (85%)
  WARNING:       1,000 (10%)
  ERROR:         500 (5%)
Top errors:      
  Connection refused: 200
  Timeout: 150
  Not found: 150

Error Analysis

ERROR [2024-01-01 10:23:45] Connection refused to database
  at Database.connect (db.js:45)
  at Application.start (app.js:23)

ERROR [2024-01-01 10:24:01] Failed to process request
  ...

Statistics (JSON)

{
  "file": "app.log",
  "total_lines": 10000,
  "date_range": {
    "start": "2024-01-01T00:00:00Z",
    "end": "2024-01-02T00:00:00Z"
  },
  "levels": {
    "INFO": 8500,
    "WARNING": 1000,
    "ERROR": 500
  },
  "top_errors": [
    {"message": "Connection refused", "count": 200},
    {"message": "Timeout", "count": 150}
  ]
}

Timeline

00:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 500
04:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 400
08:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 700
12:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 300
16:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 600
20:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 250

Examples

Quick summary:

{baseDir}/analyze.sh /var/log/app.log --summary

Find all errors:

{baseDir}/analyze.sh app.log --errors

Count log levels:

{baseDir}/analyze.sh app.log --count-by level

Top 10 IPs:

{baseDir}/analyze.sh access.log --top 10 ip

Last hour of errors:

{baseDir}/analyze.sh app.log --errors --last 1h

Extract JSON field:

{baseDir}/analyze.sh app.log --format json --unique userId

Custom pattern:

{baseDir}/analyze.sh app.log --pattern "user:\s*(\d+)" --count

Notes

• Auto-detects common log formats
• Handles both compressed (.gz) and uncompressed files
• Can process multiple files with wildcards
• Memory-efficient for large files (streaming)
• Supports date filtering for most formats