Recipes

A few pipelines that come up often.

A service that keeps restarting

journalctl -u app --since today --no-pager | logfold -n

The restart loop collapses into a few lines with counts, and the one line that is different stands out.

Container logs

kubectl logs deploy/api --tail=5000 | logfold -n -m 5

-m 5 leaves short bursts alone and folds only runs of five lines or more.

Which message repeats most

logfold -n -c app.log | sort -rn | head

With -c the count comes first, so sort -rn puts the noisiest message on top. Lines that did not repeat have no count; filter them out with grep -E '^ +[0-9]' if you only want folded ones.

Rotated files in order

logfold -n app.log.2 app.log.1 app.log

Files are read in the order given and treated as one stream.

Compressed files

zcat app.log.*.gz | logfold -n

logfold does not read compressed input itself.