Examples

Real tasks, copy-paste. Replace testdata/sample.log with your source — Log Sources.

Debug 5xx after a deploy

# which paths 500 most?
caddy-analyze top path --5xx -t 20 testdata/sample.log
# only errors from last hour, host-filtered
caddy-analyze --5xx --from 1h --host api.example.com testdata/sample.log
# compare before/after
caddy-analyze diff /var/log/caddy/before.log /var/log/caddy/after.log -f csv -o diff.csv

Hunt bots & scanners

caddy-analyze --bots-only -t 20 testdata/sample.log
caddy-analyze --no-bots --grep "wp-" testdata/sample.log
caddy-analyze top ua --bots-only testdata/sample.log
caddy-analyze top ip --no-bots --from 24h testdata/large.log

Geo — where is traffic from

caddy-analyze top country -t 15 testdata/sample.log
caddy-analyze --country IT --5xx testdata/sample.log
caddy-analyze --exclude-country CN,RU --from 7d /var/log/caddy/access.log -f html -o week.html

Needs GeoIP mmdb (auto-downloaded to ~/.config/caddy-analyzer/ on first use, see Configuration → caches).

Forensics with --detect

caddy-analyze --detect testdata/sample.log
caddy-analyze --detect --country US -f json -o suspicious.json testdata/sample.log
caddy-analyze --detect -f html -o sec.html testdata/large.log && open sec.html
# live
caddy-analyze tail docker://caddy --detect

Every hit is MITRE-tagged; export Sigma: caddy-analyze export-sigma rules.yml (see Detection).

Slow endpoints

caddy-analyze --slow 500ms -t 20 testdata/sample.log
caddy-analyze --max-latency 100ms --min-size 500kb testdata/sample.log
caddy-analyze top path --slow 1s testdata/sample.log

Operational logs

caddy-analyze --ops-only --level error,warn testdata/sample.log
caddy-analyze --watch journalctl://caddy.service  # 8th tab = Operational

↑