log-detective

Log Detective — turn a wall of log lines into the three things you needed.

summarise   level counts, time span, busiest minute, top error signatures
signatures  cluster near-identical errors by shape, not text
timeline    events per bucket, so a spike has a timestamp
grep        filtered lines with surrounding context

No network, no credentials, no parsing config. Handles plain text, and reads JSON-lines logs structurally when it detects them.

WHY IT CLUSTERS BY SIGNATURE INSTEAD OF COUNTING LINES

Ten thousand errors are usually four errors. Raw counts hide that: every line differs by a request id, a timestamp, a port number, so nothing groups and you scroll. Normalising the variable parts — numbers, hex ids, UUIDs, paths, quoted strings — collapses them into a handful of shapes, and the shape is the bug.

WHY 'BUSIEST MINUTE' IS ITS OWN NUMBER

An incident is a spike, and a spike is invisible in a total. Knowing that 80% of the day's errors landed inside one minute changes what you go and look at.

WHY IT NEVER PHONES HOME

Logs are the single most PII-dense artifact most systems produce. Anything that uploads them to be "analysed" is a data-egress decision disguised as a feature. This reads local files and returns local results.

Parameters

The typed contract this capability answers to (JSON Schema — the deterministic layer):

{
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "summarise",
        "signatures",
        "timeline",
        "grep"
      ],
      "description": "What to do."
    },
    "path": {
      "type": "string",
      "description": "Path to the log file."
    },
    "pattern": {
      "type": "string",
      "description": "For grep: a regular expression."
    },
    "context": {
      "type": "integer",
      "description": "For grep: lines of context. Default 1."
    },
    "top": {
      "type": "integer",
      "description": "How many signatures/buckets. Default 10."
    }
  },
  "required": [
    "action",
    "path"
  ]
}