How to sort and filter a Graylog export

Graylog is a log management platform. When you search it, you can export the matching messages as a CSV file. Each row is one log entry, usually with a time, a source (often the pod, host or service name) and the message. An export from several sources is often out of time order, because each source's lines arrive in a different order. Putting them back into one timeline, and filtering them, is the job this guide covers.

Why sort by time first

Most debugging questions are about sequence: what happened first, and what followed. A list sorted by source shows each service on its own. A list sorted by time shows how the services affected each other. Sort by time first, then filter. Filtering an unsorted export makes the order of events harder to see.

Filtering like grep

grep is the standard command-line tool for finding lines that match a pattern. Two options cover most needs: -i ignores case, so error also matches ERROR, and -v inverts the match, which removes lines you do not want. Chaining them with a pipe narrows the result step by step, for example:

grep -i "error" | grep -v health

This keeps lines containing "error" and drops those that mention health checks, which are often noisy. -C 3 adds three lines before and after each match, which helps when the cause is just above the error.

Stack traces and multi-line messages

A Java or Python exception can run to dozens of lines, but it is one event. In a CSV export, a stack trace may be split across rows, or it may arrive as one long field. Keep it together when you read it. Search for the exception name, not for the first line of the trace, so you find the whole block.

A simple routine

1. Export the search as CSV. Keep at least the time, source and message columns. Compressed exports (.zip or .gz) are often fine as well, as long as the CSV is inside.
2. Check the columns. Confirm the time column is the one you expect, and that the time zone is consistent. A mix of UTC and local time looks like a clock problem.
3. Sort oldest first. Read the errors in sequence before you filter anything.
4. Narrow to one source. Look at one pod or service at a time, then bring the others back in when you need to compare.
5. Filter one step at a time. Add a single grep rule, check what it removed, and only then add the next. This way you know which rule dropped a line you needed.
6. Look for bursts and pauses. A cluster of errors in a short time, a long garbage-collection pause, or a reconnect storm usually marks where an incident started. Note the timestamp, then look at what happened just before it.
7. Save the result. Keep the sorted, filtered CSV with a note of the grep rules you used, so someone else can repeat the steps.

If you want a browser tool for this

You can do all of this in a spreadsheet or with the command line. If you prefer a browser tool, the Log Sorter on TinyPDF.in takes a Graylog CSV, puts it in time order, applies grep-style filters and keeps stack traces in one row. It runs on your device, and your export is not uploaded. For logs that are plain text files rather than a CSV, the Log Playground can open them side by side. The guide to reading production logs explains where sorting fits into a wider investigation.

Questions