CheckcraftLog analysis without programming: where to start
Checkcraft is a desktop app for checking APIs and logs without code, with a free edition. Download, no sign-up →
There are usually too many logs to read in order. Analysis starts with the question you need answered and narrowing the data down to one operation.
Phrase a question and a time window
Not “what is in the logs” but “why did order 1042 fail to pay at 14:05”. Take a window of a few minutes around the event, minding the server time zone. A narrow window and a specific operation turn thousands of lines into dozens.
Find the operation ID
If the application logs a traceId or requestId, find it in the API response or the first record and search by it: this collects every step of one operation across services. Without an ID, search by order or user number, though that is less reliable.
# Linux: every line of one operation across files
grep -h "traceId=abc123" *.log
# Linux: how many errors of each kind
grep -h "ERROR" app.log | sort | uniq -c | sort -rn | head
# Windows PowerShell: lines with the traceId
Select-String -Path *.log -Pattern "traceId=abc123"Compare with normal behaviour
A single ERROR line says little: some errors are logged during normal operation too. Find the same operation that succeeded and compare the sequence of steps. The point where the paths diverge is usually the cause.
When the logs are in Kibana
In Kibana Discover the same steps are filters: the time window, the traceId field, the level and the service. If you test an API and look for the same events in the logs every time, it can be automated: Checkcraft sends the request, finds log records by traceId and checks that the expected events are there and errors are not.
Repeat this on your own API
Checkcraft is a desktop app that saves API response checks without code and shows what did not match. Start with a sample, then use your own sanitized data. Free runs on Windows and Linux with no time limit.
Download FreeDownload and first runNo sign-up or email needed, the archive is ready in a couple of minutes. See the edition limits.
Start with the linked example and compare its result with your own test requirement.