Exports and Samples

CSV for a spreadsheet

kelora examples/api_logs.jsonl -l error -k timestamp,service,status,message -F csv

timestamp,service,status,message
2025-01-15T10:24:12Z,auth-service,500,Connection timeout while validating user credentials
2025-01-15T10:25:18Z,database,,Database connection pool exhausted
2025-01-15T10:25:45Z,api-gateway,401,Invalid JWT token provided
2025-01-15T10:26:44Z,auth-service,403,Unauthorized access attempt detected
2025-01-15T10:27:26Z,storage,413,File upload failed - size limit exceeded
2025-01-15T10:28:50Z,api-gateway,404,Endpoint not found
2025-01-15T10:30:56Z,payment-service,402,Payment declined by provider
2025-01-15T10:31:38Z,api-gateway,503,Service unavailable

Add -o errors.csv to write a file. To rename a column, rename the field: -e 'e.rename_field("ts", "timestamp")'.

Share failed requests with a vendor

Non-2xx only, users replaced by stable pseudonyms, client IPs cut to /16, query strings (which can carry IDs) removed:

KELORA_SECRET=change-me kelora examples/web_access.log \
  --filter 'e.status < 200 || e.status >= 300' \
  -e 'if e.has("user") { e.user = pseudonym(e.user, "user") }
      e.ip = e.ip.mask_ip(2); e.path = e.path.split("?")[0]' \
  -k ts,path,status,user,ip -F csv

ts,path,status,user,ip
15/Jan/2025:10:25:45 +0000,/api/reports,500,h8PdOqeiAIp7U4ZorL34rll6,198.51.0.0
15/Jan/2025:10:26:44 +0000,/admin,403,,172.16.0.0
15/Jan/2025:10:27:26 +0000,/api/upload,413,jjHXplZLec8wboc4rjGDRW-k,198.51.0.0
15/Jan/2025:10:28:29 +0000,/static/app.js,304,AWWJtPLWBSlB8cgNM7mSh2JA,192.168.0.0
15/Jan/2025:10:28:50 +0000,/wp-admin,404,,172.16.0.0

A reproducible 10 % sample

Hash a stable field, so the same requests are chosen every time:

kelora examples/web_access_large.log.gz --filter 'e.ip.bucket() % 10 == 0' -J -n 2

{"ts":"04/Oct/2025:10:00:19 +0200","ip":"240.61.117.79","request":"POST /extensible/morph/cross-platform HTTP/1.1","method":"POST","path":"/extensible/morph/cross-platform","protocol":"HTTP/1.1","status":203,"bytes":39437,"referer":"http://www.humanleverage.com/redefine/deliverables/transparent/cross-platform","user_agent":"Mozilla/5.0 (Windows NT 5.01) AppleWebKit/5361 (KHTML, like Gecko) Chrome/40.0.809.0 Mobile Safari/5361"}
{"ts":"04/Oct/2025:10:00:43 +0200","ip":"61.73.107.203","request":"GET /disintermediate/matrix/visionary HTTP/2.0","method":"GET","path":"/disintermediate/matrix/visionary","protocol":"HTTP/2.0","status":406,"bytes":58733,"referer":"https://www.centralmindshare.io/metrics/wireless/proactive/viral","user_agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2) AppleWebKit/5311 (KHTML, like Gecko) Chrome/39.0.811.0 Mobile Safari/5311"}

One row per array element

-e 'emit_each(e.orders, #{batch_id: e.batch_id})' replaces each event with one event per element of orders, keeping the batch ID. Add -F csv -k … for a table. Transform with Scripts