logan

Get LOGAN status: current file, line count, filter/bookmark/highlight state

Open a log file in LOGAN

Read a range of lines from the currently open log file

Search for a pattern in the currently open log file. Returns matching lines with line numbers. Pass `scope` to search only within a subset (e.g. within the active filter or a line range).

Run analysis on the currently open log file — detects crashes, counts error/warning levels, identifies top failing components, and suggests filters. Pass `scope` to analyze only a subset (e.g. the active filter, a line range, or an explicit line-set).

Semantic compression: fold the open log into its distinct message TEMPLATES (near-duplicate lines — differing only by timestamp/counter/id — collapse to one shape). Returns the top-K templates, each with a count, first→last viewerLine + timestamps, worst severity, and a few example viewerLines to dr…

Run-vs-run TEMPLATE diff: "what does this (failing) run contain that a good run does not?" Folds BOTH the open log (the target) and a reference log (given by path — opened on demand, no need to open a tab) into their distinct message templates (near-duplicate lines collapse to one shape), then set-d…

Detect contiguous REPEATING BLOCKS running down the log — a k-line block repeating back-to-back (k=1 is identical-line spam, k>1 is a repeating request/boot cycle). Returns each region as a 0-based inclusive line span with its block length, repeat ×count, how many lines it would hide if collapsed, a…

Render your investigation PROCESS as a typed workflow graph — the reusable "recipe" of HOW you investigated, not the log findings. By default it projects the current session's journal (the investigative tool calls you made, in order); pass `investigation` to project a saved investigation template by…

[Scope] Apply a filter to show only matching lines — this NARROWS the working set that later read/produce verbs (logan_search, logan_analyze, logan_extract) operate on. Supports level filtering and include/exclude patterns. (Effect layer = Scope; to only visually mark lines without narrowing, use lo…

Manage reusable named constants ("tags") — the same ones a human saves via "🔤 Save as constant". Save a value under a name, list them, or delete one; then use a value in logan_search / logan_filter. Metadata only (name→value).

Manage saved Column Layouts (named column definitions — delimiter OR regex/paint pattern + per-column name/visibility) — the same store the human Column Layouts builder / Columns window uses. list · save · delete. (To APPLY a saved layout to the view, use logan_apply_entity kind:"columnLayout".)

Remove the active filter and show all lines again

Bookmark a specific line in the log file

List all bookmarks in the currently open file

[View] Add a highlight rule to visually mark matching text in the log viewer. Visual only — it does NOT change what other tools see and does NOT narrow the working set (use logan_filter to narrow, logan_extract to write a subset out).

List all active highlight rules

Find gaps in timestamps between consecutive log lines — useful for detecting pauses, hangs, or missing data. Pass `scope` to look for gaps only within a subset (e.g. the active filter or a line range).

Statically discover the VARIABLES in the open log (key=value, key: value, JSON fields). Returns each field with its inferred type (numeric/boolean/string/array), how often it occurs, distinct-value count, and example values. Start here to see what is worth trending — no AI, instant.

Trend ONE field over time. Returns adaptive time buckets (count, plus sum/min/max/avg for numeric fields, or top categorical values per bucket) and a sampled set of raw points with viewerLine for click-to-navigate. Use for "how did value X change over time" and to spot when it went bad.

Detect every point where a field's value CHANGES (a "flip") from one occurrence to the next — works for any type (string/bool/enum/array). Returns each transition with fromValue, toValue, and viewerLine. Ideal for "what changed right before the bug" / state-machine tracking.

Cross-tab a field against an EVENT to answer "when X happens, what is field v? when it does not, what is v?". For lines containing `event` (case-insensitive substring) vs not, summarizes the field — numeric: count/min/max/mean per group; categorical: value distribution per group. Use to find what co…

Compute a trend AND DISPLAY it as a chart cell in LOGAN's Trends panel for the user to see (and click into). Use this — not the bare logan_trend_* tools — when you want the user to SEE the trend. Call it repeatedly to build a vertical sequence of charts (e.g. show several related fields in order). R…

Return the ordered list of investigative tool calls (search/filter/analyze/trend/investigate/…) recorded so far this session — i.e. the LOGIC you followed to investigate. Use it to show the user the steps you took for a ticket before saving them as a reusable template.

Save the investigative steps recorded so far as a NAMED, re-runnable template (an "investigate pattern"). Values like component/field/pattern/event become fill-in parameters so the template can be replayed on a different log. Optionally attach `requirements` — the preconditions the log must meet for…

Attach or replace the requirements manifest on an EXISTING saved investigation (does not touch its recorded steps). Use to add a file-template gate or expected-entity refs after the fact. Pass requirements:null to clear.

Mark WHICH step of a saved recipe produces its ANSWER — the valuable output that answers the recipe's aim (e.g. the analyze step that determines "did the unit sleep?"). When set, running the recipe surfaces that step's result up front as "the answer", not just a step log. Pass the 0-based `stepIndex…

Classify a saved recipe as 'fundamental' (a reusable single-aim building block, e.g. "check S2R flow failure/stall") or 'complex' (a multi-step / composite workflow that chains fundamentals). This drives the grouped Fundamental/Complex view in the Recipes panel. Recipes have a smart default already …

Curate a saved investigation's fill-in parameters so it becomes a REAL, portable template. Label each value 'variable' (prompted + changeable when replaying on the next bug log) or 'constant' (pinned — the fixed shape of the hunt, shown read-only). You can also attach a description, PROMOTE an arbit…

List saved investigation templates (re-runnable patterns), each with its steps and fill-in parameters.

Replay a saved investigation template by name on the CURRENT log, re-running its recorded steps in order. First runs a REQUIREMENTS PREFLIGHT: if the investigation declares a file-template (column layout / format the log must match) and the open log does not match, the replay is BLOCKED and a `requi…

Fork a saved investigation into a NEW named instance with tweaked nouns baked in as its new captured defaults ("save as a new instance"). Applies `params` overrides to the source template's steps and saves the result under `newName` — the killer replay ergonomic: adapt a past root-cause hunt (e.g. a…

Compose a COMPLICATED recipe out of simpler saved recipes — chain sub-recipes, optionally with CONDITIONALS. Each step names a saved sub-recipe (from logan_list_investigations), optional `params` to pass into it (its fill-ins), and an optional `when` guard that runs the step ONLY IF the PREVIOUS ste…

Preflight a saved investigation's requirements against the CURRENTLY open log WITHOUT running it — answers "would this investigation apply to this file?". Returns per-requirement checks (file-template match, referenced entities) and whether a replay would be blocked. Use before logan_run_investigati…

List every saved/reusable entity in LOGAN as ONE catalog — searches, search sessions, filter presets, highlight groups, bookmark sets, column layouts, column patterns, constants, trend properties, saved patterns, context definitions, baselines, investigations, and clue sequences (ordered evidence tr…

Apply a saved LENS entity to the open view — the write-half of logan_entities (which only lists). Supported kinds: `filter` (apply a saved filter preset), `highlightGroup` (paint a saved highlight set), `columnLayout` (show/name columns per a saved layout), `session` (apply a saved search-config ses…

Export LOGAN's reusable GLOBAL catalogue (searches, sessions, single-sessions, filter presets, highlight groups, bookmark sets, column layouts, column patterns, constants, trend properties, saved patterns, context definitions, clue sequences, investigations, baselines) into ONE portable `.logan-pack…

Import a portable `.logan-pack` into LOGAN's global catalogue — the agent half of the human ⤒ Import button. DEFAULTS TO A DRY RUN: it returns a plan (per kind: how many would be added vs already exist) plus an integrity report, and writes NOTHING. Review the plan, then call again with `dryRun:false…

Save (or replace) a named "clue sequence" — an ORDERED evidence trail of the log lines / ranges / signal values / findings that show what went wrong across the incident, in time order. This is the EVIDENCE twin of a saved investigation (which records the PROCESS / ordered tool calls); a sequence rec…

Append ONE clue to a named clue sequence (creates the sequence if it does not exist yet) — the natural "collect as you investigate" gesture for the agent. Call it each time you find a piece of evidence, exactly like pinning a finding with logan_report_finding. See logan_save_sequence to write a whol…

Scroll the LOGAN UI to a specific line number

Save current analysis as a named baseline for future comparison

List all saved baselines

Compare current log against a saved baseline, returns findings with severity

Delete a saved baseline

Quick triage: "What's wrong with this log?" — returns severity, summary, crashes, failing components, time gaps, and filter suggestions in a single call. Automatically annotates crash sites and top failing components in the viewer.

Fetch this FIRST. Assembles one compact "evidence pack" for the open log — severity, level counts, grouped crashes, top failing components, top time gaps, the discovered field vocabulary, filter hints, and (optionally) a baseline delta — in a single call. Everything is references (viewerLine) + coun…

Produce the native root-cause VERDICT for the open log — the AI counterpart to LOGAN's human "Conclusion" panel. Deterministically (no AI) assembles what LOGAN already computes — analysis (crashes, levels, failing components), time gaps, and pinned findings/annotations — into: a plain verdict, the F…

Deep-dive on crashes: returns every crash site with surrounding context lines so the AI can reason about root causes. Automatically annotates each crash site in the viewer.

Focus on one component's health: shows error/warning/info breakdown, sample lines per level, and error sites with context. Automatically annotates the first error site.

Enriched baseline comparison: compares current log against a saved baseline and returns findings with actual evidence lines from the log

Analyze a specific time window: "What happened between 14:00 and 15:00?" — returns level counts, crashes, time gaps, and sample lines for the period

Read the notes for the currently open log file. Notes are stored in .logan/<filename>.notes.txt alongside the log file.

Write notes for the currently open log file. By default appends to existing notes with a separator. Set append=false to overwrite.

Save the current investigation as LOGAN's universal Log Analysis Report — a self-contained markdown DOCUMENT in the open log's .logan/reports/ folder, ready to read, share, or paste into Jira. Give it a clear NAME (title), the AIM (what you set out to find or prove) and the REASON (why — the trigger…

Read the agent memory note for the current log file. Memory persists across sessions so you can resume analysis where you left off.

Save a memory note for the current log file. Use this to record findings, progress, and next steps so you can resume analysis in a future session.

Read the static-environment context manifest for the current log file — the build id, firmware, device model, feature flags and config the log was captured under. These facts are auto-included in logan_evidence_pack, written into logan_save_report, and stored in baseline fingerprints. Returns the at…

Attach STATIC-environment facts to the current log file — build id, firmware, device model, feature flags, config values: the "what was this system" context that conditions the whole analysis (time-varying signals belong in trends/Signals instead). Facts are key→value strings, e.g. {"build":"4.2.1",…

Delete a bookmark by its ID. Use logan_bookmarks to list all bookmarks and get their IDs.

Update a bookmark's label or color. Use logan_bookmarks to list all bookmarks and get their IDs.

Remove all bookmarks from the currently open file

Delete a highlight rule by its ID. Use logan_highlights to list all highlights and get their IDs.

Update a highlight rule's pattern or colors. Use logan_highlights to list all highlights and get their IDs.

Remove all highlight rules from the currently open file

Add an annotation/comment to a specific log line or range of lines. Use this during analysis to mark important findings — crashes, errors, anomalies, patterns — so the user can see them highlighted in the annotation bar and panel.

List all agent annotations on the currently open file

Remove an agent annotation by ID

Send a message to the LOGAN user. The message appears in the Chat panel inside LOGAN.

Wait for the LOGAN user to send a message via the Chat panel. Blocks until a message arrives or timeout. Use this for interactive conversations.

Get the full chat message history between agent and user

Surface a specific finding to the user: annotates the line/range in the viewer, navigates to it, and sends a chat message — all in one call. Use this whenever you identify a critical point, anomaly, or root cause so it is immediately visible in the log viewer.

Hand off a batch of findings to LOGAN in ONE call. Each finding becomes a clickable, severity-coded annotation in the viewer, grouped under a named "handoff" the user can review and tick off in the AI Annotations panel. Use this to transfer a whole investigation into LOGAN so the user can continue t…

[Produce] Extract the current active FILTER subset into a NEW file and return its path + line count — this WRITES a new artifact on disk (contrast logan_filter, which only narrows the in-view set, and logan_highlight, which only marks it visually). Requires an active filter — call logan_filter first…

Compile a pattern through LOGAN's controlled-pattern ladder and validate it BEFORE using it in a search/filter. Modes: "plain" (literal text, with matchCase/wholeWord/invert), "grok" (%{NAME} tokens), "paint" (named spans over a sample), "regex" (raw regex, validated + bounded). Returns { ok, source…