analyzing-claude-sessions

Analyzing Claude Code Session Logs

Extract insights from Claude Code session transcripts using jq. Session logs are JSONL files where each line is a message in the conversation.

Log Locations

Log Type	Path
Main session	~/.claude/projects/{project-hash}/{session-id}.jsonl
Subagent	~/.claude/projects/{project-hash}/{session-id}/subagents/agent-{agent-id}.jsonl
Tool results	~/.claude/projects/{project-hash}/{session-id}/tool-results/

Find the most recent session:

ls -t ~/.claude/projects/*/*.jsonl | head -1

List subagents for a session:

ls ~/.claude/projects/{project-hash}/{session-id}/subagents/

Message Structure

Each JSONL line has this shape:

{
  "type": "user|assistant|progress|system|file-history-snapshot",
  "message": {
    "role": "user|assistant",
    "content": "string" | [{"type": "text|tool_use|tool_result", ...}],
    "model": "claude-sonnet-4-5-...",
    "usage": {"input_tokens": N, "output_tokens": N, ...},
    "stop_reason": "end_turn|tool_use|..."
  },
  "timestamp": "ISO8601",
  "uuid": "...",
  "agentId": "...",
  "sessionId": "..."
}

Assistant messages have content as an array of blocks:

• {"type": "text", "text": "..."} — text output
• {"type": "tool_use", "name": "Read", "id": "toolu_...", "input": {...}} — tool call
• {"type": "tool_result", "tool_use_id": "toolu_...", "content": "...", "is_error": bool} — tool response

Shell Quoting Note

jq filters work fine inline as long as the file path is either a literal or expanded in the same && chain as the variable assignment. The select(.type == "tool_use") syntax with inner double quotes works correctly inside single-quoted jq filters.

For array content blocks, use the if type == "array" guard since user messages have string content:

jq -r '.message.content | if type == "array" then [.[] | select(.type == "tool_use") | .name] | .[] else empty end' session.jsonl

For loops over subagent files, assign the directory path first:

SUBS="path/to/subagents" && for f in "$SUBS"/agent-*.jsonl; do
  jq -r '...' "$f"
done