analyze_logs.py

import json
import sys
from collections import defaultdict


def analyze_logs(log_file):
    """
    Analyze structured logs and group by correlation ID

    Args:
        log_file: Path to log file with JSON logs
    """
    correlation_groups = defaultdict(list)

    with open(log_file, "r", encoding="utf-8") as f:
        for line in f:
            line = line.strip()

            if not line:
                continue

            try:
                entry = json.loads(line)
            except json.JSONDecodeError:
                continue

            correlation_id = entry.get("correlation_id")
            if not correlation_id:
                continue

            correlation_groups[correlation_id].append(entry)

    if not correlation_groups:
        print("No structured log entries with correlation IDs found.")
        return

    for correlation_id, entries in correlation_groups.items():
        entries.sort(key=lambda item: item.get("timestamp", ""))

        services = []
        for entry in entries:
            service_name = entry.get("service", entry.get("name", "unknown-service"))
            if service_name not in services:
                services.append(service_name)

        print("=" * 80)
        print(f"Correlation ID: {correlation_id}")
        print(f"Log Entries   : {len(entries)}")
        print(f"Services      : {', '.join(services)}")
        print("Request Flow  :")

        for entry in entries:
            timestamp = entry.get("timestamp", "unknown-time")
            service = entry.get("service", entry.get("name", "unknown-service"))
            message = entry.get("message", "no-message")
            print(f" - {timestamp} | {service} | {message}")

        print()


if __name__ == '__main__':
    if len(sys.argv) > 1:
        analyze_logs(sys.argv[1])
    else:
        print("Usage: python3 analyze_logs.py <log_file>")