Logging for Debugging — Using Logs Effectively for Root Cause Analysis

// Log-based root cause analysis tool
class RootCauseAnalyzer {
  constructor(searchClient) {
    this.searchClient = searchClient;
  }

  async analyzeIncident(correlationId, options = {}) {
    const {
      timeRange = { before: 600000, after: 300000 }, // 10 min before, 5 min after
      includeRelated = true
    } = options;

    // Get all logs in the time range
    const logs = await this.getLogsByCorrelationId(correlationId, timeRange);

    if (logs.length === 0) {
      return { error: 'No logs found for correlation ID', correlationId };
    }

    // Build timeline
    const timeline = this.buildTimeline(logs);

    // Identify errors
    const errors = logs.filter(l => l.level === 'ERROR' || l.level === 'FATAL');

    // Find first error
    const firstError = errors.sort((a, b) =>
      new Date(a.timestamp) - new Date(b.timestamp)
    )[0];

    // Trace service boundaries
    const serviceChain = this.traceServiceChain(logs);

    // Identify slow operations
    const slowOps = logs.filter(l => l.duration && l.duration > 1000);

    return {
      correlationId,
      duration: this.calculateTotalDuration(logs),
      totalLogs: logs.length,
      errorCount: errors.length,
      firstError,
      serviceChain,
      slowOperations: slowOps,
      timeline,
      relatedCorrelationIds: this.findRelated(includeRelated ? logs : []),
      recommendation: this.generateRecommendation(errors, slowOps)
    };
  }

  buildTimeline(logs) {
    return logs
      .sort((a, b) => new Date(a.timestamp) - new Date(b.timestamp))
      .map(l => ({
        time: l.timestamp,
        level: l.level,
        service: l.service?.name,
        message: l.message?.slice(0, 200),
        duration: l.duration
      }));
  }

  traceServiceChain(logs) {
    const services = new Set();
    const chain = [];
    for (const log of logs.sort((a, b) => new Date(a.timestamp) - new Date(b.timestamp))) {
      const service = log.service?.name;
      if (service && !services.has(service)) {
        services.add(service);
        chain.push({ service, firstSeen: log.timestamp });
      }
    }
    return chain;
  }

  generateRecommendation(errors, slowOps) {
    // Simple recommendation engine
    if (errors.some(e => e.error?.code?.includes('TIMEOUT'))) {
      return 'Investigate downstream service timeouts. Check connection pools and network latency.';
    }
    if (slowOps.length > 3) {
      return 'Performance regression detected. Review recent deployments and database query plans.';
    }
    return 'No obvious pattern detected. Manual investigation required.';
  }
}