logpilot

Pipe logs into your terminal, get AI root cause analysis. Parses any log format — JSON, syslog, plain text — and sends errors to Claude for diagnosis.

$ cat app.log | logpilot

  logpilot
  ─────────────────────────────────
  Lines:    2,847
  Errors:   23
  Warnings: 41
  Span:     4m12s
  Sources:  api, db, cache
  ─────────────────────────────────

  Analysis

  **Root Cause:** The PostgreSQL connection pool is exhausted. At 10:32:14,
  the pool hit its max of 20 connections. All subsequent queries queue and
  timeout after 30s, cascading into HTTP 503s on the API layer.

  **Failure Chain:**
  1. Slow query on `orders` table (sequential scan, missing index on `user_id`)
  2. Connections held longer than usual → pool fills up
  3. New requests can't acquire connections → timeout after 30s
  4. API returns 503 → upstream load balancer marks instance unhealthy

  **Fix:**
  1. Add index: `CREATE INDEX idx_orders_user_id ON orders(user_id)`
  2. Increase pool size to 50: `max_connections=50` in pg config
  3. Add connection timeout: `pool.setConnectionTimeout(5000)`

  **Prevention:**
  - Set up slow query logging (log_min_duration_statement = 1000)
  - Alert on connection pool utilization > 80%

Install

go install github.com/divinedev111/logpilot/cmd/logpilot@latest

Usage

# Pipe from stdin
cat app.log | logpilot
kubectl logs deploy/api | logpilot
docker logs web --tail 1000 | logpilot
journalctl -u myapp --since "1 hour ago" | logpilot

# Read from file
logpilot -f /var/log/app.log

# Limit lines
logpilot -n 5000 -f app.log

# Dry run (see the prompt without calling the API)
cat app.log | logpilot --dry-run

Log Format Support

logpilot auto-detects the log format:

JSON logs — works with any field naming convention:

{"timestamp":"2024-01-15T10:30:45Z","level":"error","message":"connection refused","service":"api"}
{"ts":1705312245,"lvl":"warn","msg":"high latency detected"}

Structured text logs:

2024-01-15 10:30:45.123 ERROR [api-handler] connection timeout
[2024-01-15 10:30:45] WARN: disk usage at 90%

Syslog:

Jan 15 10:30:45 web-01 nginx[1234]: upstream timed out

Plain text — falls back to keyword detection:

ERROR: database connection pool exhausted
Something went wrong: error connecting to redis

Configuration

Environment Variable	Description	Default
ANTHROPIC_API_KEY	Claude API key (required)	—
LOGPILOT_MODEL	Claude model to use	claude-sonnet-4-20250514
NO_COLOR	Disable colored output	—

How It Works

1. Parse — Reads log lines from stdin or file. Detects format (JSON, syslog, text) and extracts timestamp, level, message, source.
2. Summarize — Groups errors by message, identifies stack traces, computes statistics (time range, error frequency, sources).
3. Analyze — Builds a structured prompt with deduplicated errors, warnings, and stack traces. Streams Claude's response in real-time.

Architecture

cmd/logpilot/
  main.go               CLI entry point, stdin/file reading
internal/
  parser/
    parser.go            Log line parsing and level detection
    json.go              JSON log parser (handles multiple field conventions)
    text.go              Text/syslog log parser (regex-based format detection)
  analyzer/
    analyzer.go          Claude API streaming client
    prompt.go            Log summarization and prompt construction
  output/
    formatter.go         Terminal output with ANSI colors

License

MIT