Log Check

Investigate logs in ELK — time window, KQL, error patterns, redacted samples, correlation, report. Primary log-ops skill. Evidence-only.

KhaiTrang1995 24030a4 1.3 KB Updated

File contents

/log-check — Log Investigation

Examples

/log-check booking-api --env prod --since 1h --level ERROR
/log-check "timeout payment" --since 30m
/log-check booking-api @logs-sample.ndjson

Process

1. Frame

Symptom, service, env, window, timezone, data view (or TBD), available paste?

2. Query plan (READ-ONLY)

service.name: "{{service}}" and env: "{{env}}" and log.level: error

Refine with symptom keywords. See @references/kql-cheat.md.

3. Analyze evidence only

Timeline, top patterns (log-patterns.md), ≤10 redacted samples, deploy window, correlate metrics/deps.

4. Conclude

Findings, ranked hypotheses, READ-ONLY next steps, MUTATIVE human-only options, escalate if user-facing impact.

5. Output

Chat summary always; optional L1 save → docs/ops/elk/log-checks/{id}.md

Definition of done

See ELK-BRAIN.md — query, evidence, hypothesis, next step.

Output template

@_templates/log-check-report.md

Rules

  • No invented counts/stacks; redact secrets; no delete-index “fixes”
  • @.claude/rules/elk-conventions.md
  • @.claude/rules/approval-gate.md

KhaiTrang1995/agentic-awesome-kits/tree/main/kits/devops/elk-kit/.claude/skills/log-check commit 24030a4f14

Frequently asked questions

npx skillmds@latest add khaitrang1995/log-check