Skip to content
FrostyBee Docs LogoFrostyBee Docs

Investigating a Log Incident

This guide takes you from a large log file and the time of an incident to the error lines that matter, with the request involved highlighted, the key lines bookmarked, and your notes ready to paste into a ticket.

Before you start: have a log file whose lines start with a timestamp and a level word, such as ERROR. The steps use this excerpt from a file named app.log, around an incident at 14:03 UTC:

app.log (excerpt)
2026-09-26T14:02:58.311Z INFO  api request id=r-1041 path=/orders user=alice
2026-09-26T14:03:01.020Z WARN  db pool 90% used
2026-09-26T14:03:04.877Z ERROR api request id=r-1042 timeout after 5000 ms
2026-09-26T14:03:04.880Z INFO  api retry id=r-1042 attempt=1
2026-09-26T14:03:09.902Z ERROR api request id=r-1042 timeout after 5000 ms retry=1
2026-09-26T14:03:10.004Z ERROR payment failed {"id":"r-1042","code":"E_TIMEOUT","amount":42.5}
java.net.SocketTimeoutException: Read timed out
    at com.example.Db.query(Db.java:88)
2026-09-26T14:03:31.500Z INFO  db pool 40% used

Find the incident

Section titled “Find the incident”

  1. Open the log and check its timestamps

    Open app.log. The ERROR lines are tinted red and the WARN line yellow. The timestamp item in the status bar shows ISO 8601. If it shows No timestamps, select it and choose the format that matches your log. See Timestamps and go to time.

  2. Go to the time of the incident

    Press Ctrl + Shift + T. Wait until the hint under the box shows the file’s time range, type 2026-09-26 14:03, and press Enter. The WARN db pool 90% used line, the first one at or after 14:03:00, becomes the active line. In a long log, Vaste also scrolls it to the top of the view.

  3. Look for pauses

    Press Ctrl + K, type delta, and run Toggle delta-t gutter. Next to each line number, Vaste shows the time since the previous timestamped line. The last line shows +21.496s: nothing was logged for 21 seconds after the payment failure. The stack trace lines have no timestamp, so they show no value.

In a long log, the time histogram beside the scrollbar also shows when the file is busy or quiet. Select a bar to jump to that time.

Narrow down the errors

Section titled “Narrow down the errors”

Find the error lines about timeouts that were not retried, by combining three searches. See Combining searches.

  1. Search for errors

    Press Ctrl + F, type ERROR, and press Enter. The counter shows 1/3: the first of three matches.

  2. Start a chain

    In the Combine searches section of the search panel, select Add current. The ERROR search becomes the first row of the chain.

  3. Add the timeouts

    Search for timeout. Leave the operator next to Add current set to AND, and select Add current.

  4. Leave out the retries

    Search for retry. Set the operator to NOT, and select Add current.

  5. Run the chain

    Select Run chain. The status line starts with 1 line matches ERROR AND timeout NOT retry, and Grep view opens with that line and the lines around it.

The 14:03:09 error is not in the result because it contains retry=1. The payment failed line is not there either: it contains E_TIMEOUT, and search matches case unless you turn on Aa.

Follow the request

Section titled “Follow the request”

  1. Pin the result

    In the search panel, select More actions (…), then Pin. The Pinned results panel opens with the chain’s result, which stays there while you run other searches. See Pinned results.

  2. Return to Text view

    Select Exit Filter in the search panel, or press Ctrl + Shift + G.

  3. Highlight the request ID

    On the 14:03:04 error line, select r-1042 with the mouse and press Alt + H. Every r-1042 in the file is colored, including the retry and the payment lines. See Highlighters.

  4. Read the payload

    Right-click the payment failed line and select Show JSON. The dialog shows the payload formatted, with "code": "E_TIMEOUT" on its own line. Press Esc to close it. See JSON in a line.

  5. Bookmark the key lines

    Click the 14:03:04 error line and press m, then e. Click the payment failed line and press m, then p. To return to a line later, press ', then the letter. See Bookmarks.

  6. Collect your notes

    Right-click the payment failed line and select Send to scratchpad. The scratchpad opens with the line. Type your notes under it, then select Copy to put everything on the clipboard. See Scratchpad.

At the end, you have the incident’s error line pinned, the request highlighted in every line it appears in, two bookmarks to return to, and notes ready to paste.

Tips

Section titled “Tips”
  • Size the problem first: to see how many lines mention a word before you list them, use Count in the search panel’s actions row. See Searching a file.
  • Anchor to the start of a line: to find lines whose level is ERROR, not lines that only mention it, use a regular expression with (?m), such as (?m)^\S+ ERROR. See Search modes.
  • Clean up highlighters: highlighter rules apply to every file you open. Delete the r-1042 rule in the Highlighters dialog (Ctrl + Shift + H) when you finish.
  • Bookmarks in a live log: bookmarks keep their line numbers. In a log that only grows at the end, they stay in place, but if the log is rotated or rewritten while you work, they can mark different lines. See Bookmarks.

Next steps

Section titled “Next steps”