Log Analysis Automation — Automating Log Analysis with Scripts

// Automated log analysis engine
class LogAnalyzer {
  constructor() {
    this.analyzers = [
      new ErrorRateAnalyzer(),
      new SlowEndpointAnalyzer(),
      new ErrorPatternAnalyzer(),
      new UserActivityAnalyzer()
    ];
  }

  async analyze(logs) {
    const results = {};
    for (const analyzer of this.analyzers) {
      results[analyzer.name] = await analyzer.analyze(logs);
    }
    return results;
  }
}

// Error rate analyzer
class ErrorRateAnalyzer {
  get name() { return 'errorRate'; }

  async analyze(logs) {
    const errors = logs.filter(l => l.level === 'ERROR' || l.level === 'FATAL');
    const total = logs.length;

    return {
      errorRate: total > 0 ? (errors.length / total) * 100 : 0,
      errorCount: errors.length,
      totalCount: total,
      byCode: this.groupBy(errors, 'error.code'),
      byEndpoint: this.groupBy(errors, 'request.path')
    };
  }

  groupBy(logs, field) {
    return logs.reduce((acc, log) => {
      const value = field.split('.').reduce((obj, key) => obj?.[key], log) || 'unknown';
      acc[value] = (acc[value] || 0) + 1;
      return acc;
    }, {});
  }
}

// Slow endpoint analyzer
class SlowEndpointAnalyzer {
  get name() { return 'slowEndpoints'; }

  async analyze(logs) {
    const requestLogs = logs.filter(l => l.type === 'response' && l.duration);
    const byEndpoint = {};

    for (const log of requestLogs) {
      const key = `${log.request?.method} ${log.request?.path}`;
      if (!byEndpoint[key]) {
        byEndpoint[key] = { total: 0, count: 0, max: 0, slowCount: 0 };
      }
      byEndpoint[key].total += log.duration;
      byEndpoint[key].count++;
      byEndpoint[key].max = Math.max(byEndpoint[key].max, log.duration);
      if (log.duration > 1000) byEndpoint[key].slowCount++;
    }

    return Object.entries(byEndpoint)
      .map(([endpoint, stats]) => ({
        endpoint,
        averageMs: Math.round(stats.total / stats.count),
        maxMs: stats.max,
        slowPercentage: Math.round((stats.slowCount / stats.count) * 100)
      }))
      .sort((a, b) => b.averageMs - a.averageMs);
  }
}

// Scheduled report generation
async function generateDailyReport() {
  const yesterday = new Date(Date.now() - 86400000).toISOString().slice(0, 10);
  const logs = await queryLogs({ from: yesterday, to: new Date().toISOString() });
  const analysis = await analyzer.analyze(logs);
  await slackClient.send({ channel: '#ops-logs', attachments: [formatReport(analysis)] });
}