Node.js wrapper for the Logoscope log analysis CLI
npm install @probelabs/logoscopeGigabytes of logs → kilobytes of AI-ready insights.
Pattern and anomaly log extraction for AI and humans.
Turn millions of log lines into structured intelligence that fits in AI context windows. Every spike, drift, and anomaly — instantly queryable.
``bashAdd to Claude Desktop
claude mcp add logoscope -- npx -y @probelabs/logoscope@latest mcp
Claude will automatically use fast triage analysis first, then deep analysis if needed.
$3
bash
Step 1: Quick triage (fast anomaly detection)
npx -y @probelabs/logoscope@latest --triage logs/app-*.logStep 2: Full analysis (if anomalies found)
npx -y @probelabs/logoscope@latest logs/app-*.log --out insights.jsonStreaming logs
kubectl logs -n prod deploy/web --since=30m | npx -y @probelabs/logoscope@latest --triage
journalctl -u api -o json | npx -y @probelabs/logoscope@latest --out insights.json
`The Problem
Production is down. Your logs are gigabytes of noise: thousands of identical lines, buried anomalies, and patterns too complex for grep. Uploading to AI fails — context windows overflow, tokens waste on repetition, and temporal patterns vanish in copy-paste.
How It Works
Logoscope uses the Drain algorithm to extract log templates, replacing variables with wildcards. We identify anomalies (new patterns, frequency spikes, numeric outliers), track temporal dynamics (bursts, gaps, trends), and compress millions of lines into kilobytes of structured JSON.
What You Get
- Pattern extraction with severity levels and trend analysis
- Temporal anomalies with exact timestamps and burst detection
- Schema tracking for field additions, removals, and type changes
- Parameter statistics with cardinality analysis and value distributions
- AI-ready JSON that fits in context windows
- Queryable access to raw logs with context
Installation
$3
bash
npm i -g @probelabs/logoscope
`The npm package auto-downloads the platform-specific binary during installation.
$3
Download from GitHub Releases and add to PATH.
$3
bash
cargo build --release
Binary at target/release/logoscope
`Core Usage
$3
Always start with
for rapid anomaly detection, then run full analysis if needed:`bash
Step 1: Quick triage (seconds)
logoscope --triage logs/*.logStep 2: Full analysis (if anomalies found)
logoscope logs/*.log --out analysis.json
`$3
Extract logs from specific time periods when investigating incidents:
bash
Analyze last hour's logs
logoscope --triage \
--start 2024-01-15T14:00:00Z \
--end 2024-01-15T15:00:00Z \
logs/*.logGet logs around an incident with context
logoscope --only logs \
--start 2024-01-15T14:19:00Z \
--end 2024-01-15T14:25:00Z \
--before 5 --after 5 \
logs/*.log
`$3
Monitor logs in real-time:
bash
Stream with triage mode
tail -F /var/log/app.log | logoscope --follow --triageKubernetes logs
kubectl logs -f deployment/api | logoscope --follow --triage
`Output Format
Logoscope produces structured JSON optimized for both AI consumption and human analysis:
json
{
"summary": {
"total_lines": 523412,
"unique_patterns": 142,
"compression_ratio": 3686.7,
"start_date": "2024-01-15T00:00:00Z",
"end_date": "2024-01-15T23:59:59Z"
},
"patterns": [{
"template": "ERROR Database connection failed: <*>",
"total_count": 11700,
"frequency": 0.0234,
"severity": "ERROR",
"pattern_stability": 0.82,
"temporal": {
"bursts": 2,
"largest_burst": "2024-01-15T14:20:00Z",
"trend": "increasing"
},
"param_stats": {
"ERROR_CODE": {
"cardinality": 3,
"values": [
{ "value": "timeout", "count": 8000 },
{ "value": "refused", "count": 3200 }
]
}
}
}],
"anomalies": {
"temporal_anomalies": [{
"type": "FrequencySpike",
"template": "ERROR Database connection failed: <*>",
"at": "2024-01-15T14:20:00Z",
"value": 127,
"baseline": 18
}],
"pattern_anomalies": [{
"type": "NewPattern",
"template": "WARN retry=<> exceeded for op=<>",
"first_seen": "2024-01-15T14:19:45Z"
}]
}
}
`Real Questions, Real Answers
Ask questions that matter:
- "What spiked at 14:20?" — Get exact patterns with frequency analysis
- "Show new error patterns from today" — Identify newly emerged issues
- "Which fields changed before the outage?" — Track schema evolution
- "Extract payment failures with context" — Query specific patterns with surrounding lines
Advanced Usage
$3
- Auto-detection: JSON and plaintext per line
- Multi-line: Stack traces and bracket-balanced JSON
- Timestamps: ISO8601, syslog, epoch (auto-detected)
$3
- Fast: ~3 seconds for 100k log lines
- Scalable: Fixed-depth Drain tree, bounded memory
- Parallel: Multi-threaded pattern extraction
- Streaming: Rolling windows for continuous analysis
$3
Built-in PII protection with smart masking:
-
, , , , , , ,
- Preserves structure while protecting sensitive dataMCP Server Configuration
For AI assistants and editors, configure the MCP server:
json
{
"mcpServers": {
"logoscope": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@probelabs/logoscope@latest", "mcp"]
}
}
}
`Available MCP tools:
-
: Quick triage analysis
- full_log_analysis: Comprehensive analysis
- patterns_table: Pattern-focused view
- logs_slice: Time-windowed log extractionExamples
$3
`bash
1. Quick triage to find issues
logoscope --triage prod-*.log2. Focus on database errors
logoscope --only patterns --match "database|timeout" --level error prod-*.log3. Extract specific time window with context
logoscope --only logs \
--start 2024-01-15T14:15:00Z \
--end 2024-01-15T14:30:00Z \
--pattern "ERROR Database connection failed: <*>" \
--before 2 --after 2 \
prod-*.log
`$3
bash
Find latency outliers
logoscope api-*.log | jq '.anomalies.field_anomalies[] | select(contains("latency"))'Extract slow requests
logoscope --only logs --pattern "latency_ms=<>" --min-value 5000 api-.log
`$3
bash
Stream with anomaly detection
tail -F /var/log/app.log | logoscope --follow --triage --interval 10Watch for specific patterns
tail -F app.log | logoscope --follow --match "ERROR|CRITICAL" --alert-threshold 10
``We welcome contributions! Check out our contributing guide for details.
MIT
---
Built by Probelabs — for debugging at scale.