log-diveUnified log search across Loki, Elasticsearch, and CloudWatch. Natural language queries translated to LogQL, ES DSL, or CloudWatch filter patterns. Read-only...
Install via ClawdBot CLI:
clawdbot install tkuehnl/log-diveSearch logs across Loki, Elasticsearch/OpenSearch, and AWS CloudWatch from a single interface. Ask in plain English; the skill translates to the right query language.
⚠️ Sensitive Data Warning: Logs frequently contain PII, secrets, tokens, passwords, and other sensitive data. Never cache, store, or repeat raw log content beyond the current conversation. Treat all log output as confidential.
This skill activates when the user mentions:
permissions:
exec: true # Required to run backend scripts
read: true # Read script files
write: false # Never writes files — logs may contain secrets
network: true # Queries remote log backendsEach backend uses environment variables. Users may have one, two, or all three configured.
| Variable | Required | Description |
|----------|----------|-------------|
| LOKI_ADDR | Yes | Loki server URL (e.g., http://loki.internal:3100) |
| LOKI_TOKEN | No | Bearer token for authentication |
| LOKI_TENANT_ID | No | Multi-tenant header (X-Scope-OrgID) |
| Variable | Required | Description |
|----------|----------|-------------|
| ELASTICSEARCH_URL | Yes | Base URL (e.g., https://es.internal:9200) |
| ELASTICSEARCH_TOKEN | No | Basic or Bearer for auth |
| Variable | Required | Description |
|----------|----------|-------------|
| AWS_PROFILE or AWS_ACCESS_KEY_ID | Yes | Standard AWS credentials |
| AWS_REGION | Yes | AWS region for CloudWatch |
Follow this sequence:
Run the backends check to see what's configured:
bash <skill_dir>/scripts/log-dive.sh backendsParse the JSON output. If no backends are configured, tell the user which environment variables to set.
This is the critical step. Convert the user's natural language request into the appropriate backend-specific query. Use the query language reference below.
For ALL backends, pass the query through the dispatcher:
# Search across all configured backends
bash <skill_dir>/scripts/log-dive.sh search --query '<QUERY>' [OPTIONS]
# Search a specific backend
bash <skill_dir>/scripts/log-dive.sh search --backend loki --query '{app="checkout"} |= "error"' --since 30m --limit 200
bash <skill_dir>/scripts/log-dive.sh search --backend elasticsearch --query '{"query":{"bool":{"must":[{"match":{"message":"error"}},{"match":{"service":"checkout"}}]}}}' --index 'app-logs-*' --since 30m --limit 200
bash <skill_dir>/scripts/log-dive.sh search --backend cloudwatch --query '"ERROR" "checkout"' --log-group '/ecs/checkout-service' --since 30m --limit 200Before searching, you may need to discover what's available:
# Loki: list labels and label values
bash <skill_dir>/scripts/log-dive.sh labels --backend loki
bash <skill_dir>/scripts/log-dive.sh labels --backend loki --label app
# Elasticsearch: list indices
bash <skill_dir>/scripts/log-dive.sh indices --backend elasticsearch
# CloudWatch: list log groups
bash <skill_dir>/scripts/log-dive.sh indices --backend cloudwatchbash <skill_dir>/scripts/log-dive.sh tail --backend loki --query '{app="checkout"}'
bash <skill_dir>/scripts/log-dive.sh tail --backend cloudwatch --log-group '/ecs/checkout-service'Tail runs for a limited time (default 30s) and streams results.
After receiving log output, you MUST:
NEVER dump raw log output to the user. Always summarize, extract patterns, and present structured findings.
When the conversation is happening in a Discord channel:
Show Error TimelineShow Top Error PatternsRun Related Service QueryLogQL has two parts: a stream selector and a filter pipeline.
Stream selectors:
{app="myapp"} # exact match
{namespace="prod", app=~"api-.*"} # regex match
{app!="debug"} # negative matchFilter pipeline (chained after selector):
{app="myapp"} |= "error" # line contains "error"
{app="myapp"} != "healthcheck" # line does NOT contain
{app="myapp"} |~ "error|warn" # regex match on line
{app="myapp"} !~ "DEBUG|TRACE" # negative regexStructured metadata (parsed logs):
{app="myapp"} | json # parse JSON logs
{app="myapp"} | json | status >= 500 # filter by parsed field
{app="myapp"} | logfmt # parse logfmt
{app="myapp"} | regexp `(?P<ip>\d+\.\d+\.\d+\.\d+)` # regex extractCommon patterns:
{app="checkout"} |= "error" | json | level="error"{app="api"} | json | status >= 500{app="api"} | json | duration > 5s{app="myapp"} |= "Exception" |= "at "Simple match:
{"query": {"match": {"message": "error"}}}Boolean query (AND/OR):
{
"query": {
"bool": {
"must": [
{"match": {"message": "error"}},
{"match": {"service.name": "checkout"}}
],
"must_not": [
{"match": {"message": "healthcheck"}}
]
}
},
"sort": [{"@timestamp": "desc"}],
"size": 200
}Time range filter:
{
"query": {
"bool": {
"must": [{"match": {"message": "timeout"}}],
"filter": [
{"range": {"@timestamp": {"gte": "now-30m", "lte": "now"}}}
]
}
}
}Wildcard / regex:
{"query": {"regexp": {"message": "error.*timeout"}}}Common patterns:
{"query":{"bool":{"must":[{"match":{"message":"error"}},{"match":{"service.name":"checkout"}}]}}}{"query":{"range":{"http.status_code":{"gte":500}}}}"aggs" — but prefer simple queries for agent useSimple text match:
"ERROR" # contains ERROR
"ERROR" "checkout" # contains ERROR AND checkoutJSON filter patterns:
{ $.level = "error" } # JSON field match
{ $.statusCode >= 500 } # numeric comparison
{ $.duration > 5000 } # duration threshold
{ $.level = "error" && $.service = "checkout" } # compoundNegation and wildcards:
?"ERROR" ?"timeout" # ERROR OR timeout (any term)
-"healthcheck" # does NOT contain (use with other terms)Common patterns:
"ERROR"{ $.level = "error" && $.service = "checkout" }{ $.statusCode >= 500 }"Exception" "at "When presenting search results, use this structure:
## Log Search Results
**Backend:** Loki | **Query:** `{app="checkout"} |= "error"`
**Time range:** Last 30 minutes | **Results:** 47 entries
### Error Summary
| Error Type | Count | First Seen | Last Seen | Service |
|-----------|-------|------------|-----------|---------|
| NullPointerException | 23 | 14:02:31 | 14:28:45 | checkout |
| ConnectionTimeout | 18 | 14:05:12 | 14:29:01 | checkout → db |
| HTTP 503 | 6 | 14:06:00 | 14:27:33 | checkout → payment |
### Root Cause Analysis
1. **14:02:31** — First `NullPointerException` in checkout service...
2. **14:05:12** — Database connection timeouts begin...
### Recommended Actions
- [ ] Check database connection pool settings
- [ ] Review recent deployments to checkout service
---
*Powered by Anvil AI 🤿*duration > 5s) → identify common patterns → check for database slow queries → check for external service timeouts.| Error | Cause | Fix |
|-------|-------|-----|
| "No backends configured" | No env vars set | Set LOKI_ADDR, ELASTICSEARCH_URL, or configure AWS CLI |
| "logcli not found" | logcli not installed | Install from https://grafana.com/docs/loki/latest/tools/logcli/ |
| "aws: command not found" | AWS CLI not installed | Install from https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html |
| "curl: command not found" | curl not installed | apt install curl or brew install curl |
| "jq: command not found" | jq not installed | apt install jq or brew install jq |
| "connection refused" | Backend unreachable | Check URL, VPN, firewall rules |
| "401 Unauthorized" | Bad credentials | Check LOKI_TOKEN, ELASTICSEARCH_TOKEN, or AWS credentials |
Powered by Anvil AI 🤿
Generated Mar 1, 2026
During a flash sale, the checkout service experiences high latency and errors. An SRE uses log-dive to search across Loki and CloudWatch logs to identify timeout exceptions and database connection pool exhaustion, correlating errors between payment and inventory services to pinpoint the root cause within minutes.
A DevOps engineer receives alerts for increased 5xx errors in an API gateway. Using log-dive, they query Elasticsearch and Loki logs to trace the errors to a recent deployment in the user-service, analyzing log patterns to identify a configuration mismatch and roll back the change.
A compliance officer needs to audit access logs for suspicious activities across multiple services. Log-dive enables searching CloudWatch and Elasticsearch logs with natural language queries to extract login failures and unauthorized access attempts, ensuring sensitive data like PII is handled securely without storage.
A healthcare IT team investigates intermittent failures in a patient portal. Using log-dive, they tail logs from Loki and Elasticsearch to monitor live errors, identifying correlation between service outages and third-party API timeouts, which helps prioritize fixes to maintain system reliability.
During a major game launch, developers notice lag spikes in multiplayer sessions. They use log-dive to search across all configured backends, translating queries to find latency patterns and error logs in real-time, enabling quick optimization of server resources and network configurations.
Offer log-dive as a premium feature within an observability platform, charging monthly fees based on log volume and number of integrated backends. This model targets enterprises needing unified log search across hybrid cloud environments, with tiered pricing for small to large teams.
Provide a free version with basic log search capabilities for single backends, while premium plans include advanced features like cross-service correlation, longer retention, and priority support. Upsell to larger organizations requiring incident response and compliance tools.
Monetize by offering professional services to set up and customize log-dive for clients, including configuration of backends, training for SRE teams, and ongoing support. This model leverages the skill's complexity to provide tailored solutions for specific industry needs.
💬 Integration Tip
Ensure environment variables for each backend are securely configured, and use the backends check command to verify connectivity before performing searches to avoid errors.
Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of what changed.
Full desktop computer use for headless Linux servers. Xvfb + XFCE virtual desktop with xdotool automation. 17 actions (click, type, scroll, screenshot, drag,...
Essential Docker commands and workflows for container management, image operations, and debugging.
Tool discovery and shell one-liner reference for sysadmin, DevOps, and security tasks. AUTO-CONSULT this skill when the user is: troubleshooting network issues, debugging processes, analyzing logs, working with SSL/TLS, managing DNS, testing HTTP endpoints, auditing security, working with containers, writing shell scripts, or asks 'what tool should I use for X'. Source: github.com/trimstray/the-book-of-secret-knowledge
Deploy applications and manage projects with complete CLI reference. Commands for deployments, projects, domains, environment variables, and live documentation access.
Monitor topics of interest and proactively alert when important developments occur. Use when user wants automated monitoring of specific subjects (e.g., product releases, price changes, news topics, technology updates). Supports scheduled web searches, AI-powered importance scoring, smart alerts vs weekly digests, and memory-aware contextual summaries.