# Log Triage

> Summarizes local application or identity logs from a JSONL or text file. Counts levels, groups repeated messages, and prints the latest errors. Use when the user pastes logs, names a log file, or asks to triage, investigate, or summarize errors without a live Elastic or SIEM cluster.

- Skill: `kelvint-cli/log-triage` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add kelvint-cli/log-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kelvint-cli/log-triage/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- Author: kelvint-cli (https://skillmd.com/u/kelvint-cli)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/kelvint-cli/log-triage

---


# Log triage

Read a local log file. Do not call a remote cluster, VPN, or employer API.

## When to use

The user has a `.jsonl`, `.log`, or `.txt` export and wants a short incident-style summary.

## How to run

```bash
python3 skills/log-triage/scripts/triage.py PATH_TO_LOG
```

From this repo:

```bash
python3 skills/log-triage/scripts/triage.py skills/log-triage/fixtures/sample.jsonl
```

The script accepts JSON Lines objects with `timestamp`, `level`, `source`, and `message`. Plain text lines are treated as messages with level `INFO`, or `ERROR` if the line contains `error` or `fail`.

## What to report

1. Time range and line count.
2. Counts by level.
3. Top repeated messages (max 5).
4. Last 5 error-level lines, verbatim.
5. One sentence on what to check next. Do not invent a root cause.

## Rules

- Do not send log contents to a third-party API unless the user asks.
- Redact emails, tokens, and hostnames that look internal before quoting in chat, unless the file is the bundled fixture.
- If the file is empty or unreadable, say so and stop.