…or drag them here. Open several and they get interleaved by timestamp. Nothing is uploaded to any server.
How to use
What it is and what it is for
Paste a log or open a file and this tool understands it: it detects the format, groups lines into events (a 40-line stack trace is ONE event, not 40), mines the patterns that repeat, points at the root cause of exceptions, and shrinks it so you can paste it into an AI without spending a fortune in tokens. All in your browser: the log never leaves your machine.
Why an event is not a line
If you filter by ERROR line by line, you keep the header of the failure and lose the stack trace, which is exactly what you were going to read. Here the continuations (at …, Caused by:, File "…", line N) are attached to their event before anything filters, counts or shrinks.
Patterns
"connected to 10.0.0.1" and "connected to 10.0.0.7" are the same message. Grouping them turns a million-line log into two hundred things a person can read. Out of that come the error rate per pattern, what shows up only once (usually what you were after), and the comparison between two runs.
For AI
Trims the log to a token budget you set, keeping the errors with their stack trace, what happened just before, and the exceptional bits; repeated lines are summarised with their count. Tokens are counted with the model's real tokenizer, not an estimate. And you can mask the secrets before copying.
Hygiene
Checks whether your log is well written: passwords printed out, the same line forty thousand times, timestamps without a timezone (which make it impossible to correlate two machines), everything at the same level, or no identifier to follow a request with.
Container logs (wrapped)
What comes out of docker logs as JSON, Kubernetes (CRI), journalctl -o json, OpenTelemetry (OTLP JSON) or CloudTrail is wrapped: your application's text is inside, and split up. A Java stack trace arrives as forty separate records. The wrapper is recognised, the inner text is taken out, the pieces are joined back and it is analysed as if it were the original log; the wrapper's date and level are only used when the text has none of its own.
What sets these events apart?
Filter what you care about (the errors, a time range) and press What sets… apart?: it tells you which field=value pairs show up far more there than in the rest of the log. “92 % of the errors are version=2.4.1, against 10 % of the rest” is the clue you will not spot reading three hundred errors one by one. It is a comparison of proportions, not a statistical test: the events of a log are not independent.
Collectors
How Filebeat, Fluent Bit, Alloy and Vector would group this same log with their multiline rule, next to how this tool groups it, with the differences marked: the way to see, before deploying, that your collector is going to split the stack traces. And it writes the rule for all four from what was detected, in each one's regular-expression dialect.
Follow live
Like tail -f. Open the file with Open file(s) and turn on Follow live: every 2 seconds it checks whether it has grown and, if so, re-reads the end and the viewer scrolls to the latest. If it is truncated or rotated, you are told. It needs a browser that can read an already chosen file again (Chrome or Edge on a computer); in the others the switch does not appear, and opening a folder still gives today's state of a rotated series.
What it does NOT do
It does not connect to any server: what is followed live is a file on your disk, not a network stream. Of a very large file a window is analysed (start or end) and you are told which — to go through hundreds of GB there is the Giant file viewer.
