Log Analyzer

Problem

Debugging production incidents often stalls when logs are too large and inconsistent. nginx, Apache, application, and system logs use different formats, and manual grep gives isolated lines without error distribution, latency percentiles, slow requests, or suspicious access patterns. This skill turns raw logs into structured analysis for faster diagnosis, performance review, and security checks.

How It Works

It parses Combined / JSON, Common / Combined, Syslog, and custom regex formats, then reports four metric groups:
- Errors: error types, trends, stack extraction, and top frequent errors.
- Performance: response-time distribution, P50/P90/P95/P99, slow requests, throughput, and peak windows.
- Traffic: PV/UV, top URLs, status-code distribution, User-Agent, and IP geolocation.
- Security: SQL injection, XSS, brute-force patterns, and IP blacklist suggestions.
Output can be rendered as text, json, or html, and can feed ELK, Grafana, DingTalk/Feishu webhooks, or CI/CD checks.

Limits And Notes

Large files should be sliced first or analyzed in streaming mode. Run it cautiously in production to avoid extra load. Passwords and tokens are masked, but full logs still need careful handling. Generated HTML reports should be cleaned up regularly.