logtap

Captures, triages, and analyzes ephemeral Kubernetes logs in real-time via CLI and sidecar injection.

Updated Feb 13, 2026
One-click install
npx skills add https://github.com/ppiankov/logtap --skill logtap
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: logtap
Source: https://github.com/ppiankov/logtap/tree/main/docs
Command: npx skills add https://github.com/ppiankov/logtap --skill logtap

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires kubernetes, loki, yaml, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides an efficient way to capture and triage logs in Kubernetes environments, allowing for real-time analysis and incident response.

Core Features & Use Cases

  • Ephemeral Log Capture: Capture and store logs temporarily for load testing and incident investigation.
  • Real-time TUI: Monitor and analyze logs in real-time with a command-line interface.
  • Sidecar Injection: Automatically inject a log-forwarding sidecar into Kubernetes workloads without changing logging configurations.
  • Replay: Replay captured logs at original speed or fast-forward for analysis.
  • Analysis: Summarize, filter, convert logs to different formats, and scan for anomalies.
  • Cluster Safety: Validate cluster readiness, detect orphaned sidecars, and show tapped workloads.
  • Use Case: During a load test, use this Skill to capture and analyze logs in real-time, identify issues, and troubleshoot them promptly.

Quick Start

Start the log receiver by running the command: logtap recv --dir ./capture --max-disk 50GB --redact

Frequently Asked Questions about logtap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I capture Kubernetes logs temporarily for incident triage?

Capture Kubernetes logs temporarily by injecting a log-forwarding sidecar into workloads, storing them ephemerally without external storage or forwarding. This enables real-time analysis and incident triage without altering logging configurations.

How does sidecar injection work for Kubernetes log aggregation?

Sidecar injection for Kubernetes log aggregation works by automatically adding a log-forwarding container to workloads. It captures logs without changing existing logging configurations, ensuring cluster safety by validating readiness and detecting orphaned sidecars.

Can I replay captured Kubernetes logs for load testing analysis?

You can replay captured Kubernetes logs for load testing analysis at original speed or fast-forward. The captured logs can be summarized, filtered, converted to different formats, and scanned for anomalies.

Do I need Loki to monitor Kubernetes logs in real-time?

Loki is used for log aggregation and analysis alongside a Kubernetes cluster. The real-time TUI allows you to monitor and analyze logs directly, while replaying captured logs and scanning for anomalies.

What is the best way to analyze Kubernetes logs during an incident response?

The best way to analyze Kubernetes logs during incident response is using ephemeral capture with a real-time TUI. You can identify issues, troubleshoot promptly, replay logs, and scan for anomalies without external storage.

How do I start ephemeral log capture in a Kubernetes cluster?

Start ephemeral log capture in a Kubernetes cluster by running the log receiver command with a specified directory, maximum disk space, and redaction enabled. This initiates the capture process for load testing and incident investigation.