Analyseur de Patterns de Log

Detecting Patterns in Log Content

Application logs grow rapidly — a single service can produce thousands of lines per minute. Finding meaningful patterns in this noise requires automated analysis that groups similar lines, counts occurrences, identifies log levels, and extracts structured metadata like IP addresses, HTTP status codes, and URL paths. The Log Pattern Analyzer processes your log content locally to reveal the signal buried in repetitive noise, helping you identify the most frequent errors, understand traffic patterns, and detect anomalies without transmitting sensitive log data to external services.

Paste any log content — access logs, application logs, error logs, or system logs — and receive pattern grouping that collapses thousands of similar lines into template patterns with occurrence counts, log level distribution, timestamp detection, and metadata extraction. Uses Web Workers for large log files to keep the browser responsive during analysis.

Pattern Grouping and Templates

The analyzer identifies repeated patterns by abstracting variable parts (timestamps, IDs, IPs) into placeholders:

• Template extraction: Lines like "User 123 logged in from 10.0.0.1" and "User 456 logged in from 192.168.1.1" collapse into template "User {ID} logged in from {IP}" with count 2
• Frequency ranking: Templates sorted by occurrence count — the most common patterns appear first
• Error clustering: Similar error messages grouped together regardless of varying stack traces or request IDs
• Noise detection: High-frequency informational messages identified as candidates for log level adjustment or filtering

This pattern-based view transforms thousands of raw lines into a manageable summary of 10-50 distinct patterns with their frequencies, immediately showing what your application does most often.

Log Level Detection and Distribution

The analyzer identifies log level indicators across multiple format conventions:

• Standard levels: ERROR, WARN, INFO, DEBUG, TRACE (case-insensitive)
• Bracketed formats: [ERROR], [error], [E], [err]
• Syslog severity: emerg, alert, crit, err, warning, notice, info, debug
• Level distribution: Percentage breakdown showing error-to-info ratio

An abnormally high error percentage (above 5-10%) indicates systemic issues, while a spike in warnings preceding errors suggests cascading failures that could have been caught earlier with proper alerting thresholds.

Metadata Extraction

The analyzer extracts structured metadata from unstructured log text:

• IP addresses: Both IPv4 and IPv6 addresses with frequency counts per unique address
• HTTP status codes: Response codes with distribution (2xx success, 4xx client errors, 5xx server errors)
• URL paths: Request paths with hit counts, identifying most-trafficked endpoints
• Timestamps: Detected time formats with chronological span of the log window
• User agents: Browser and bot identification strings with classification
• Request durations: Response time values for performance analysis and outlier detection

Extracted metadata is presented as a structured summary alongside the pattern analysis, giving you both the high-level overview (which patterns dominate) and the detailed breakdown (which IPs, which endpoints, which time period) needed for effective incident investigation and capacity planning decisions.

Code Examples

Access Log Analysis Output

# Input: Apache/Nginx access log (500 lines)

# Pattern Analysis Results:
# ────────────────────────
# Top patterns by frequency:
#   1. {IP} - - [{TIMESTAMP}] "GET /api/health HTTP/1.1" 200 {SIZE}    (245 occurrences)
#   2. {IP} - - [{TIMESTAMP}] "GET /static/{PATH} HTTP/1.1" 200 {SIZE} (120 occurrences)
#   3. {IP} - - [{TIMESTAMP}] "POST /api/auth/login HTTP/1.1" 401 {SIZE} (45 occurrences)
#   4. {IP} - - [{TIMESTAMP}] "GET /api/users/{ID} HTTP/1.1" 500 {SIZE} (12 occurrences)

# Status code distribution:
#   2xx: 78% | 4xx: 15% | 5xx: 7%

# Top IPs:
#   10.0.0.50 — 180 requests (likely health checker)
#   203.0.113.42 — 45 requests (failed logins — possible brute force)

# Time span: 2024-03-15 08:00 to 2024-03-15 09:00 (1 hour)