Logsift user guide
This guide explains what you see on screen in Logsift: each view, its columns, numbers, colours and buttons, and what to do about what it shows. Colours are always given with their name too, so you don’t need to tell them apart to follow along.
New to Logsift? Start with Opening logs and The log view. In the app, Help → Documentation opens this page.
Logs
| Page | What it covers |
|---|---|
| Opening logs | Files, folders, zips, .gz, web addresses, WSL, piped output, and logs on a server over SSH/SFTP |
| The log view | Lines and columns, level colours, line numbers, the highlight bar, JSON and CSV, the tree of loggers, bookmarks, merged logs |
| Split view and tabs | Two tabs side by side or one above the other, Scroll Together by line or by time, and the tab menu: copy path, reveal, close others |
| Find | The find bar, Find All, several searches at once, searching within results |
| Filters | Show, Hide and Mark filters, the formula, chips, level chips, stack traces, context lines, alerts |
| Timeline | The bar of lines over time, its colours, and picking a time range |
| Insights and messages | Error bursts, new errors, silences, restarts, noise, known problems; top messages |
| Metrics | How long things took, things that never ended, numbers in messages and columns, the chart |
| Profile | What each column of a table (a CSV file) holds, with a chart per column; filtering by a click |
| Query | SQL over a log or a table: counts, groups, time buckets, percentiles; read-only; results that go to their line |
| Pivot | A pivot table and chart of a table’s rows, as in a spreadsheet: groups, sums, counts, averages, filters |
| Exceptions | Exceptions grouped by root cause, the stack, opening your source code |
| Requests | Following one request through a log, all open logs or a folder |
| Compare files | Two CSV or TSV files as tables: rows matched by a key whatever their order, changed values as old → new |
| Compare and merge | A bad run against a good one; several logs merged by time |
| Folder search | Searching every file in a folder, inside zips and .gz files too |
Java, Python and crashes
| Page | What it covers |
|---|---|
| JVM connections | Attaching to a JVM on this computer, over SSH or a JMX port; the bar that names a log’s JVM; what each action costs a running service |
| GC logs | The GC tab: every tile, finding, colour and chart, and the thresholds behind them |
| Thread dumps | Findings (deadlocks, lock queues, stuck and busy threads), the thread list, state colours, timeline, compare |
| Profiling and flame graphs | What to measure, reading a flame graph and its colours, comparing runs |
| Heap | Live heap histograms, heap dumps (what fills the heap, why it is alive, map, waste, classes), comparing dumps, dumps on a server |
| Crash dumps | Windows dumps (.dmp, .mdmp) of any program and Java crash reports (hs_err_pid): what happened, the code to blame, every thread’s stack, which threads may have caused it, what to try |
Everything else
| Page | What it covers |
|---|---|
| Settings | Every setting and where Logsift keeps its files |
| Assistant | Asking GitHub Copilot or Claude Code about the open logs and your services’ logs, in its own tab: clickable lines, models and credits, what it’s told, every chat kept and searchable, and an audit of what went wrong |
| Coding agents | Letting GitHub Copilot, Claude Code and other agents ask Logsift about your logs; what is masked |
| Keyboard shortcuts | All the keys, by area |
| Troubleshooting and FAQ | Messages you may see, and what to do |
Colours at a glance
Most views share a few colours:
- red means errors, or something bad (for example a GC pause of a second or more).
- amber means warnings, or something to keep an eye on.
- green means fine.
- blue or gray means for information only. Gray text in a log means lines your filters leave out, or lines shown only for context.
Each page lists the exact colours of its view. Where dark mode uses other shades, the page says so.