Log Analyzer: sort, grep and filter logs
Put a Graylog export or a plain log file into time order, then grep it like a shell: grep -i "error" | grep -v health. Lines from several pods are merged, and a stack trace stays in one row. Files never leave your device.
Drop the CSV export here, or choose a file. A zip or .gz file with the CSV inside works too. Plain log files work as well: each entry starts with a timestamp.
Works with Graylog CSV exports with columns for time, source and message. Your columns are detected from the header row.
Made-up logs from three pods, so you can try every feature first.
Advanced: columns, analyze, rules
Columns
Hidden columns are not shown in the table. The download is not changed.
Analyze
Type a grep command here. It filters the table, the same way grep does in a shell.
Rules
Each rule works on the rows that pass the current filters. Periods come from the Analyze panel. Patterns are case-insensitive regular expressions. Blank settings use the defaults shown.
Error bursts ?Flags periods with many errors compared with the average period. Good for sudden failures.
Periods with many errors compared with the average period.
Long GC or pause messages ?Finds messages that report a GC or pause time above the limit, longest first. Long pauses freeze the node.
Messages that report a GC or pause time, such as "ParNew GC in 195988ms". Add a pattern to look only at some messages.
Timeout and unavailable errors ?Counts messages matching the pattern in each period. Change the pattern to match your own error text.
Counts the messages matching the pattern in each period.
Reconnect bursts ?Finds many matching messages close together, such as peers reconnecting after a node restarts or pauses.
Many matching messages close together, such as peers reconnecting after a node restart or pause.
Flush followed by a long pause ?Finds a flush message followed by a long pause within the window. Can point to a full heap.
A flush message followed by a pause within the window.
Guide
Step-by-step: How to sort and filter a Graylog export.
Questions about the Log Analyzer
What file do I need?
Export the search from Graylog as CSV. A zip or .gz file with the CSV inside also works. The file needs a header row, with a column for the time, one for the source (pod or host) and one for the message. Columns are detected from the header.
Does it keep a stack trace together?
Yes. A message that spans several lines stays in one row, and the whole row moves when you sort. The line breaks inside the message are kept when you download the sorted CSV.
Can I look at just 10 minutes of logs?
Yes. Pick a From and To time, or press Last 10 min, Last 30 min or Last hour. The window ends at the latest log line in the file. After you set a range, Earlier and Later move the same window back or forward. Times match the Time column, as written in the file.
How do I search logs with grep?
Type a command in the grep box, the way you would in a shell. Examples: grep -i "error" finds lines with error in any case. grep -v health hides health checks. grep -c ParNew counts matches. grep -n -C 2 "GC in" shows the match with two rows before and after it, numbered. Pipes chain filters: grep ERROR | grep -v timeout.
What do the grep flags mean?
-i ignores case. -v shows lines that do not match. -c shows only the count. -n shows row numbers. -w matches whole words. -E uses extended regular expressions, and -F matches plain text. -A 2, -B 2 and -C 2 show 2 rows after, before or around each match.
Can I filter by time, like the last 10 minutes?
Yes. The time range has From and To boxes in the format 2026-10-07 16:05:00, plus Last 10 min, Last 30 min and Last hour buttons. Earlier and Later move the window. The times are the ones written in the file.
Can I read plain log files, not only CSV?
Yes. Each entry starts with a timestamp, such as [2026-10-07T12:14:40,344]. Lines that do not start with a timestamp, like stack traces, stay with the entry above.
Are logs uploaded?
No. The file is read in your browser, on your device. Nothing is sent to a server.
What if a row has no readable time?
Rows whose time cannot be read are listed last, in their original order, and the count is shown above the table.