Cookbook

Short answers to common questions, each a command you can adapt. Every command runs against a file in examples/; replace it with your own log and adjust the field names (kelora yourfile -d lists them). Each recipe links to the guide page that explains the options.

Errors and incidents

• Which services fail most?
• What kinds of errors are there?
• When did it start?
• What changed after the deploy?
• Which exceptions do the stack traces contain?
• When did each exception first appear?
• Show the events around each error
• One timeline from several services

Web and API traffic

• Status codes over time
• Which endpoints fail?
• The slowest endpoints
• Latency percentiles per endpoint
• Browsers and operating systems
• Internal versus external clients

Security and privacy

• Failed SSH logins by IP and user
• Read JWT claims
• Requests from one network
• Mask addresses inside free text
• Consistent pseudonyms
• Drop sensitive fields

Parsing

• Firewall logs (KEY=VALUE pairs)
• key=value pairs inside messages
• Kubernetes container logs with JSON payloads
• Keep only the JSON lines (or only the rest)
• A custom format

Exports and samples

• CSV for a spreadsheet
• Share failed requests with a vendor
• A reproducible 10 % sample
• One row per array element

Monitoring and time

• Alert when errors spike
• Fail a CI job when the log has errors
• Detect silence
• Requests that never got a response
• Activity by hour of day
• Only business hours