victorialogs-analyzer

name	victorialogs-analyzer
description	Query and analyze VictoriaLogs logs for Kubernetes applications, Pods, containers, nodes, kubelet/containerd, error patterns, incident time windows, keyword searches, and log statistics using LogsQL.

VictoriaLogs Analyzer

Use scripts/query_logs.sh for VictoriaLogs HTTP API access. Keep queries narrow by cluster, namespace, Pod/app, and time.

Commands

# Basic query
scripts/query_logs.sh -q 'k8s_cluster:prod-cluster namespace:default error' -l 100

# Relative time
scripts/query_logs.sh -q 'k8s_cluster:prod-cluster error' -t 15m

# Absolute time
scripts/query_logs.sh -q 'namespace:production error' \
  --start '2026-01-01T00:00:00Z' \
  --end '2026-01-01T01:00:00Z'

# Text output
scripts/query_logs.sh -q 'k8s_cluster:prod-cluster pod:~"nginx-.*" error' -f text

Parameters: -q/--query, -l/--limit, -t/--time, --start, --end, -f/--format, --url, --no-segment, --max-segment.

Default API: https://victorialogs.example.com/select/logsql/query.

Query Rules

• Use short windows first; ranges over 15 minutes are auto-segmented unless --no-segment is set.
• Add k8s_cluster, namespace, and pod/app whenever possible.
• Use -l 100 to -l 500 for investigation; raise only when summarizing patterns.
• Exclude noise with NOT debug, -namespace:kube-system, or health-check filters.

LogsQL Quick Reference

• field:value: field word match, e.g. namespace:default.
• field:="value": exact match.
• field:~"regex": regex match.
• {field="value"}: stream filter, fastest when applicable.
• "keyword": contains keyword.
• NOT keyword and -field:value: exclusions.
• AND, whitespace, OR: boolean logic.
• _time:5m: time filter.
• Pipes: | stats count() by (namespace), | sort by (_time desc), | limit 100, | unpack_json.

Common fields: k8s_cluster, namespace, pod, container, app, job, _msg, _time.

Common Queries

# Pod/application logs
k8s_cluster:prod-cluster namespace:<ns> pod:<pod>
k8s_cluster:prod-cluster app:<app>

# Errors
k8s_cluster:prod-cluster namespace:<ns> (error OR exception OR fatal OR panic)
k8s_cluster:prod-cluster namespace:<ns> error NOT debug

# OOM/crash
k8s_cluster:prod-cluster (oom OR "out of memory" OR "killed process" OR OOMKilled)
k8s_cluster:prod-cluster ("container failed" OR "failed to start" OR CrashLoopBackOff)

# Network/auth/config/cert
k8s_cluster:prod-cluster ("connection refused" OR "connection timeout" OR "network unreachable" OR "no route to host")
k8s_cluster:prod-cluster ("permission denied" OR "unauthorized" OR "forbidden")
k8s_cluster:prod-cluster ("invalid config" OR "parse error")
k8s_cluster:prod-cluster (certificate OR x509 OR tls)

# System components
k8s_cluster:prod-cluster job:kubelet error
k8s_cluster:prod-cluster job:containerd
k8s_cluster:prod-cluster namespace:kube-system app:coredns

Analysis Workflow

1. Determine cluster, namespace, Pod/app/container, and incident time.
2. Start with a narrow query around the incident window.
3. Identify repeated error signatures, timestamps, affected Pods, and context before/after the first error.
4. Broaden only when confirming blast radius or frequency.
5. Summarize root cause candidates with evidence and next queries/actions.

Cluster Labels

• prod-cluster: production
• compute-cluster: compute
• tencent-cluster: Tencent Cloud
• aliyun-cluster: Alibaba Cloud

References

Load only when needed:

• references/QUICK_REFERENCE.md: syntax and query templates.
• references/logsql-syntax-guide.md: full LogsQL syntax.
• references/troubleshooting-decision-tree.md: incident flows.
• references/auto-segment-query.md: segmentation behavior.
• references/error_patterns.md: common signatures and fixes.