7.2Log Analysis Commands

Basic Log Reading

# Real-time log monitoring
tail -f /var/log/app/application.log

# Last 100 lines
tail -100 /var/log/app/application.log

# First 50 lines (check log format, headers)
head -50 /var/log/app/application.log

# Page through a large log file
less /var/log/app/application.log
# Use: / to search, n for next match, q to quit

Filtering Logs by Time

# Errors in a specific time window
awk '/2024-01-15 14:3[0-9]/' app.log | grep ERROR

# Logs from the last hour (if log format includes ISO timestamps)
awk -v start="$(date -d '1 hour ago' '+%Y-%m-%d %H:%M')" '$0 >= start' app.log

# Between two timestamps
awk '/2024-01-15 14:30/,/2024-01-15 14:45/' app.log

Structured (JSON) Logs

Many modern applications log in JSON format. Use jq to parse them:

# Pretty-print JSON log entries
cat app.json | jq .

# Filter for errors only
cat app.json | jq 'select(.level == "error")'

# Extract specific fields
cat app.json | jq 'select(.level == "error") | {timestamp, message, stack}'

# Count errors by message
cat app.json | jq -r 'select(.level == "error") | .message' | sort | uniq -c | sort -rn

# Filter by service name
cat app.json | jq 'select(.service == "payment-api" and .level == "error")'

Container Logs

# Docker container logs
docker logs test-app --tail 100 --follow

# Docker Compose logs (all services)
docker compose logs -f

# Docker Compose logs (specific service)
docker compose logs -f app

# Kubernetes pod logs
kubectl logs pod/test-app -f

# Kubernetes logs with timestamp filtering
kubectl logs pod/test-app --since=1h