---

name: log-analysis description: Analyze, filter, transform, and convert log files using Kelora. Use for parsing logs, extracting patterns, investigating incidents, calculating metrics, or converting formats. metadata: version: "1.0"

Log Analysis with Kelora

Kelora is a streaming log processor with Rhai scripting. It auto-detects formats and provides 150+ built-in functions.

Getting Help

Run these for detailed reference (prefer over asking the user):

• kelora --help-examples - Common patterns
• kelora --help-functions - All 150+ functions
• kelora --help - Full CLI reference
• kelora --help-rhai - Scripting guide

Core Patterns

Filter logs:

Copykelora -l ERROR,WARN app.log                          # By level
kelora --filter 'e.status >= 500' api.log             # By expression
kelora --since "1 hour ago" app.log                   # By time

Transform:

Copykelora -e 'e.duration_sec = e.duration_ms / 1000' api.log
kelora -e 'e.absorb_json("data")' events.log          # Parse embedded JSON

Convert formats:

Copykelora -f combined -J access.log > access.jsonl       # Apache to JSON
kelora -j -F logfmt events.jsonl                      # JSON to logfmt
kelora -f syslog -F csv syslog.log                    # Syslog to CSV

Metrics:

Copykelora -s app.log                                     # Summary stats
kelora -q --metrics -e 'track_count("by:" + e.level)' app.log

Pattern discovery:

Copykelora --drain app.log                                # Find message templates

Context around matches:

Copykelora -C 5 --filter 'e.level == "ERROR"' app.log     # 5 lines before/after

Field Access

Copye.level              // Direct
e["@timestamp"]      // Special chars
e.get_path("a.b.c")  // Safe nested (returns () if missing)
e.has("field")       // Check exists

Key Options

Tips

1. Use -f auto (default) - Kelora detects JSON, logfmt, syslog, combined, CSV
2. Preview with -n 10 or --head 100 before processing large files
3. Use -q with --metrics when you only need aggregates
4. Run kelora --help-functions to find the right function for your task