Session Logs

Session Logs

Search and analyze past Claude Code session and conversation logs using jq and rg (ripgrep). No external CLI beyond jq and rg needed.

Prerequisites

# Install jq (JSON processor)
brew install jq          # macOS
sudo apt install jq      # Ubuntu/Debian

# Install ripgrep
brew install ripgrep     # macOS
sudo apt install ripgrep # Ubuntu/Debian

# Verify
jq --version && rg --version

Common Log Locations

Commands

List recent session files:

ls -lt ~/.claude/projects/ | head -20

Search session logs by keyword:

rg "keyword" ~/.claude/projects/ --type json -l

Search with context lines:

rg -C 3 "keyword" ~/.claude/projects/ --type json

Search memory files:

rg "topic" memory/ -l
rg -i "topic" memory/learned-today.md

Parse JSONL session file:

# Show all user messages from a session file
cat <session-file.jsonl> | jq -r 'select(.role=="user") | .content'

# Show assistant messages
cat <session-file.jsonl> | jq -r 'select(.role=="assistant") | .content[:200]'

# Extract tool uses
cat <session-file.jsonl> | jq -r 'select(.type=="tool_use") | {name, input}'

Search by date range:

# Find files modified in the last 7 days
find ~/.claude/projects/ -name "*.json" -newer $(date -d "7 days ago" +%Y-%m-%d 2>/dev/null || date -v-7d +%Y-%m-%d) 2>/dev/null

# macOS: files from today
find ~/.claude/projects/ -name "*.json" -newer $(date -v-1d +%Y-%m-%d)

Search workspace saved outputs:

rg -i "keyword" workspace/ -l
rg -i -C 2 "keyword" workspace/

Analyze memory for a topic:

rg -i "keyword" memory/ --type md

Usage Examples

Find past discussion about a feature:

rg -i "authentication" memory/ workspace/ --type md -l

Search all session files for a decision:

rg -i "decided to use" ~/.claude/projects/ --type json -C 2 | head -40

Extract key points from a session file:

# Summarize assistant responses from a specific session
jq -r 'select(.role=="assistant") | .content' <session.jsonl> | head -100

Review today's memory learnings:

cat memory/learned-today.md

Rules

• Always check if jq and rg are installed first before running searches
• If not installed, show the install commands and stop
• Never read or expose raw API keys, tokens, or credentials found in logs
• Redact sensitive patterns (tokens, passwords, API keys) before showing output
• Default to searching memory/ and workspace/ first (faster); escalate to ~/.claude/projects/ if needed
• When results are large, save to workspace/session-search-<query>.md and summarize inline
• Limit inline output to 20-30 lines; always offer to save full results to workspace
• Confirm searches with: "Found matches for ''"