Log Pattern Analyzer

A log file with 5,000 lines rarely holds 5,000 different events. Most of the time it is about forty messages repeating with a different order id, timestamp or address. This analyzer swaps those variable parts for named wildcards, NUM for numbers and DATE for dates, merges the lines that became the same text and ranks the groups by frequency, showing the count, the share of the file and the first and last line number.

Masks are applied in a fixed order: date, UUID, URL, e-mail, IP, path, quoted string, hex and finally plain numbers. The order matters because a timestamp must be recognised as a date before the number rule eats it in three pieces. The severity level is read separately, among the first fields of the line, and becomes its own column, so an ERROR and an INFO carrying the same message never merge in the ranking.

The unique appearances block counts how many groups occurred exactly once. That is the rare noise, and a high number there usually means a mask is missing. If a pattern looks too broad, switch one option off and analyze again: the same log splits into finer groups. Above 20,000 lines only the first ones are counted, with a warning. The pasted text never leaves this browser tab.