Recent searches
Search options
@robjperez@fosstodon.orgVery often I need to review some logs of a given service.
I've found that #emacs is the perfect tool for analyse them. This is what I'm using:
- Occur (M-s o). Ask for a regexp and opens a new buffer with the matching lines. You can click on those lines
- `highlight-lines-matching-regexp`. This will mark in the buffer the lines. This helps a lot visualizing the important events.
- `flush-lines`: Delete all the lines that matches a regexp. To remove lines that are not adding any value
And as a bonus point, if you are analising always the same logs, the regexps needed for that will be always the same, so you can code a function to automatically highlight important events, flush those not useful and open an occur buffer with pointers to the file.
I love how customizable is #emacs and how easy it is to make it yours
@robjperez I have an eerily similar workflow
I also use `keep-lines` which is the opposite of `flush-lines`
I used to use `grep -C n` to get n lines of context before and after each regex match, but I just now realise M-x occur takes a prefix argument equivalent to `grep -C n`!
I also have a super composable #Clojure oriented log inspection toolkit of:
CIDER inspector – for inspecting different views of the logs right in emac
@robjperez
Reducibles – Concrete log sources, e.g a log file or something more complex. In my SaaS I use the Telemere logging lib. Telemere has a config map and automatically creates compressed archives of the logs. It's kinda complex to read the log entries sequentially, so I wrote a fn from the Telemere config map to a reducible which reduces each log entry sequentially.
@robjperez
(also) Reducibles – Abstract views over log sources. Easy to craft by composing a reducible and a transducer with `eduction`. E.g last 100 log entries, last 10 exception log entries, all logs from the last 24 hours
Transducers – map, filter and https://github.com/olavfosse/context for the most part
Reducers – conj and friends
I should prolly do a video cus this is terrible exposition sosorry
@robjperez fyi, there's also `keep-lines` which only keeps lines matching a regexp.
I've been using lnav for this, but Emacs can be a better choice. We can probably also combine this with TRAMP to view remote logs.