Summary
A 2GB log, reduced to the slice that explains the incident.
The agent never sees the whole file — it asks for a window, a pattern or a trace ID, and the server streams past everything else. That is the difference between 'the log is too big to read' and an answer about what happened in the minute the errors spiked.
What it is
A streaming NDJSON log reader: it filters by field, buckets errors by time window to find spikes, summarises severity over time, and reassembles a single request's events across files.
What you get
- Field and value filtering that returns the top N matches, streaming the file line by line
- Error spikes found by Z-score against the file's own mean and standard deviation
- A severity timeline per time window, with an adaptive mode that zooms into the peak at 10x finer resolution
- One trace or request ID reconstructed across multiple NDJSON files
- The log's own schema discovered, so you know which fields exist before filtering on one
- Multiline stack traces reassembled by passing a line-start pattern
Requirements
A local NDJSON log file and Node. Published on npm as ndjson-local-log-triage-mcp.
Setup effort
One command — npx -y ndjson-local-log-triage-mcp