Logsift user guide
This guide explains what you see on screen in Logsift: each view, its columns, numbers, colours and buttons, and what to do about what it shows. Colours are always given with their name too, so you don’t need to tell them apart to follow along.
New to Logsift? Start with Opening logs and The log view. In the app, Help → Documentation opens this page.
Logs
| Page | What it covers |
|---|---|
| Opening logs | Files, folders, zips, .gz, web addresses, WSL, piped output, and logs on a server over SSH/SFTP |
| The log view | Lines and columns, level colours, line numbers, the highlight bar, JSON and CSV, the tree of loggers, bookmarks, merged logs |
| Find | The find bar, Find All, several searches at once, searching within results |
| Filters | Show, Hide and Mark filters, the formula, chips, level chips, stack traces, context lines, alerts |
| Timeline | The bar of lines over time, its colours, and picking a time range |
| Insights and messages | Error bursts, new errors, silences, restarts, noise, known problems; top messages |
| Metrics | How long things took, things that never ended, numbers in messages and columns, the chart |
| Profile | What each column of a table (a CSV file) holds, with a chart per column; filtering by a click |
| Pivot | A pivot table and chart of a table’s rows, as in a spreadsheet: groups, sums, counts, averages, filters |
| Exceptions | Exceptions grouped by root cause, the stack, opening your source code |
| Requests | Following one request through a log, all open logs or a folder |
| Compare files | Two CSV or TSV files as tables: rows matched by a key whatever their order, changed values as old → new |
| Compare and merge | A bad run against a good one; several logs merged by time |
| Folder search | Searching every file in a folder, inside zips and .gz files too |
Java and Python
| Page | What it covers |
|---|---|
| JVM connections | Attaching to a JVM on this computer, over SSH or a JMX port; the bar that names a log’s JVM; what each action costs a running service |
| GC logs | The GC tab: every tile, finding, colour and chart, and the thresholds behind them |
| Thread dumps | Findings (deadlocks, lock queues, stuck and busy threads), the thread list, state colours, timeline, compare |
| Profiling and flame graphs | What to measure, reading a flame graph and its colours, comparing runs |
| Heap | Live heap histograms, heap dumps (what fills the heap, why it is alive, map, waste, classes), comparing dumps, dumps on a server |
Everything else
| Page | What it covers |
|---|---|
| Settings | Every setting and where Logsift keeps its files |
| Coding agents | Letting GitHub Copilot and other agents ask Logsift about your logs; what is masked |
| Keyboard shortcuts | All the keys, by area |
| Troubleshooting and FAQ | Messages you may see, and what to do |
Colours at a glance
Most views share a few colours:
- red means errors, or something bad (for example a GC pause of a second or more).
- amber means warnings, or something to keep an eye on.
- green means fine.
- blue or gray means for information only. Gray text in a log means lines your filters leave out, or lines shown only for context.
Each page lists the exact colours of its view. Where dark mode uses other shades, the page says so.