Quick scan of a log file: size, line count, time range, level distribution, and head/tail samples.

Use this as the first step when investigating a log file.

Search log entries by regex pattern, log level, and/or time range.

Returns matching entries (up to max_results). Combine filters to narrow results.

Extract a segment of a log file by line range or time range.

Use line ranges for precise extraction (e.g., around a known error line). Use time ranges to get all entries within a time window.

Analyze error entries: deduplicate by fingerprint, count frequencies, extract stack traces.

Groups similar error messages together even when they differ in numbers, IDs, or timestamps.

Compute log statistics: volume histogram over time, level breakdown, and top repeated message patterns.

Useful for spotting traffic spikes, error bursts, or noisy log sources.

Compare multiple log files and find entries unique to each file.

Normalises variable parts (numbers, UUIDs, hex) so that messages differing only in IDs or timestamps are treated as the same pattern. Returns patterns that appear in some files but not in others, helping you focus on what is different rather than what is common. Also shows shared patterns and frequency outliers where the same pattern appears with very different counts across files.

Classify log lines as LOOK (interesting) or SKIP (routine) using a trained ML model.

Uses a logistic regression model trained on 17 loghub datasets (345M lines). Lines classified as LOOK include errors, warnings, security events, resource exhaustion, hardware anomalies, and other operationally significant entries.

Args: file_path: Path to the log file to classify. threshold: Probability threshold for LOOK classification (0.0-1.0, default 0.5). Lower values capture more lines but with more false positives. max_lines: Maximum number of lines to process (0 = all lines). max_look_lines: Maximum number of LOOK lines to return in detail (default 200). output: Output format - "summary" for overview stats + sample LOOK lines, "look_only" for all captured LOOK lines with probabilities.