winsorllc --- name: log-analyzer description: "Analyze log files for patterns, errors, statistics. Parse common log formats, extract insights, generate reports. No API key required."
Log Analyzer Skill
Parse and analyze log files for patterns, errors, trends, and statistics.
When to Use
✅ USE this skill when:
- "Analyze this log file"
- "Find errors in logs"
- "Extract patterns from logs"
- "Statistics from log file"
- "Count log entries by type"
When NOT to Use
❌ DON'T use this skill when:
- Real-time log streaming → use file-watcher + tail
- Structured data analysis → use json-yaml-query
- Log shipping → use log forwarders
Commands
Basic Analysis
{baseDir}/analyze.sh <logfile>
{baseDir}/analyze.sh /var/log/app.log
{baseDir}/analyze.sh app.log --summary
Error Analysis
{baseDir}/analyze.sh app.log --errors
{baseDir}/analyze.sh app.log --errors-only
{baseDir}/analyze.sh app.log --error-count
{baseDir}/analyze.sh app.log --error-pattern "Failed|Error|Exception"
Pattern Matching
{baseDir}/analyze.sh app.log --pattern "user: \d+"
{baseDir}/analyze.sh app.log --pattern "error|warning" --count
{baseDir}/analyze.sh app.log --pattern "Exception" --context 3
Time-based Analysis
{baseDir}/analyze.sh app.log --time-range "2024-01-01" "2024-01-02"
{baseDir}/analyze.sh app.log --last 1h
{baseDir}/analyze.sh app.log --last 24h
{baseDir}/analyze.sh app.log --hourly
{baseDir}/analyze.sh app.log --timeline
Log Formats
{baseDir}/analyze.sh access.log --format apache
{baseDir}/analyze.sh nginx.log --format nginx
{baseDir}/analyze.sh app.log --format json
{baseDir}/analyze.sh syslog --format syslog
{baseDir}/analyze.sh app.log --format custom --regex '\[(.*?)\] (\w+): (.*)'
Statistics
{baseDir}/analyze.sh app.log --stats
{baseDir}/analyze.sh app.log --count-by level
{baseDir}/analyze.sh app.log --count-by hour
{baseDir}/analyze.sh app.log --unique "ip"
{baseDir}/analyze.sh app.log --top 10 error
Options
| Option | Description | Default |
|---|---|---|
--summary |
Show summary overview | false |
--errors |
Show error entries | false |
--errors-only |
Only show errors (hide others) | false |
--error-pattern REGEX |
Custom error pattern | built-in |
--pattern REGEX |
Search for pattern | None |
--count |
Count pattern matches | false |
--context N |
Show N lines of context | 0 |
--time-range START END |
Filter by time range | None |
--last DURATION |
Last N duration (e.g., 1h, 24h, 7d) | None |
--hourly |
Group by hour | false |
--timeline |
Show events timeline | false |
--stats |
Show statistics | false |
--count-by FIELD |
Count by field | None |
--unique FIELD |
Unique values in field | None |
--top N FIELD |
Top N values by field | None |
--format FORMAT |
Log format: apache, nginx, json, syslog, custom | auto-detect |
--regex REGEX |
Custom regex for format | None |
--output FORMAT |
Output format: text, json, csv | text |
Log Formats
Apache Combined Log
127.0.0.1 - - [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326
Auto-detected. Use --format apache.
Nginx Log
127.0.0.1 - - [10/Oct/2000:13:55:36 +0000] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0"
Auto-detected. Use --format nginx.
JSON Log
{"timestamp": "2024-01-01T00:00:00Z", "level": "INFO", "message": "Started"}
Auto-detected. Use --format json.
Syslog
Jan 1 00:00:00 hostname process[pid]: message
Auto-detected. Use --format syslog.
Custom Format
Use --regex to define custom format with capture groups:
{baseDir}/analyze.sh app.log --format custom --regex '\[(.*?)\] (\w+): (.*)'
Output Examples
Summary
Log Analysis Summary: app.log
================================
Total lines: 10,000
Date range: 2024-01-01 to 2024-01-02
Log levels:
INFO: 8,500 (85%)
WARNING: 1,000 (10%)
ERROR: 500 (5%)
Top errors:
Connection refused: 200
Timeout: 150
Not found: 150
Error Analysis
ERROR [2024-01-01 10:23:45] Connection refused to database
at Database.connect (db.js:45)
at Application.start (app.js:23)
ERROR [2024-01-01 10:24:01] Failed to process request
...
Statistics (JSON)
{
"file": "app.log",
"total_lines": 10000,
"date_range": {
"start": "2024-01-01T00:00:00Z",
"end": "2024-01-02T00:00:00Z"
},
"levels": {
"INFO": 8500,
"WARNING": 1000,
"ERROR": 500
},
"top_errors": [
{"message": "Connection refused", "count": 200},
{"message": "Timeout", "count": 150}
]
}
Timeline
00:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 500
04:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 400
08:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 700
12:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 300
16:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 600
20:00 ΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöüΓöü 250
Examples
Quick summary:
{baseDir}/analyze.sh /var/log/app.log --summary
Find all errors:
{baseDir}/analyze.sh app.log --errors
Count log levels:
{baseDir}/analyze.sh app.log --count-by level
Top 10 IPs:
{baseDir}/analyze.sh access.log --top 10 ip
Last hour of errors:
{baseDir}/analyze.sh app.log --errors --last 1h
Extract JSON field:
{baseDir}/analyze.sh app.log --format json --unique userId
Custom pattern:
{baseDir}/analyze.sh app.log --pattern "user:\s*(\d+)" --count
Notes
- Auto-detects common log formats
- Handles both compressed (.gz) and uncompressed files
- Can process multiple files with wildcards
- Memory-efficient for large files (streaming)
- Supports date filtering for most formats