Monitoring and Time¶

Alert when errors spike¶

Print a line whenever a minute has more than a threshold of failures:

kelora examples/api_latency_incident.jsonl -q --span 1m \
  -e 'if e.status >= 500 { track_inc("failed") }' \
  --span-close 'let n = span.metric("failed"); if n >= 3 { print(`ALERT ${span.label}: ${n} failed requests`) }'

ALERT 2025-01-20T14:20:00Z: 4 failed requests
ALERT 2025-01-20T14:21:00Z: 4 failed requests
ALERT 2025-01-20T14:22:00Z: 3 failed requests
ALERT 2025-01-20T14:24:00Z: 4 failed requests

On a live stream (tail -F app.log | kelora -j -q --span 1m …), a minute's alert prints when the first line of the next minute arrives.

Fail a CI job when the log has errors¶

kelora ci.log -q --assert 'e.level != "ERROR"' exits 1 if any event breaks the assertion. Output and Integration

Detect silence¶

Compare each event with the previous one using --window 1. Cross-Event Logic has the command.

Requests that never got a response¶

Remember requests in state, remove them when the response arrives, and print what's left in --end. Cross-Event Logic

Activity by hour of day¶

kelora examples/web_access_large.log.gz -m -e 'track_freq("hour", meta.parsed_ts.to_timezone("Europe/Berlin").hour())'

hour         (3 values):
  value  count
  11       630
  10       566
  12         4

Only business hours¶

kelora examples/simple_json.jsonl -k timestamp,message -n 3 \
  --filter 'meta.parsed_ts.to_timezone("Europe/Berlin").hour() in 9..17'

timestamp='2024-01-15T10:00:00Z' message='Application started'
timestamp='2024-01-15T10:00:05Z' message='Loading configuration'
timestamp='2024-01-15T10:00:10Z' message='Connection pool initialized'

Work with Time