skills.rest
incidentfox
incidentfoxOFFICIAL
Explore all skills by this author →
WebsiteGitHub

victorialogs-analysis

Query and analyze VictoriaLogs data using LogsQL with statistics-first investigation workflows.

656|82|Updated Jan 20, 2026
Search Tags:#sre#error patterns#logsql#Log Analysis#Observability#Incident Investigation#victorialogs
One-click install
npx skills add https://github.com/incidentfox/incidentfox --skill victorialogs-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: victorialogs-analysis
Source: https://github.com/incidentfox/incidentfox/tree/main/sre-agent/.claude/skills/observability-victorialogs
Command: npx skills add https://github.com/incidentfox/incidentfox --skill victorialogs-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires httpx, and includes scripts (resource) components.

What problem does it solve?

Investigating production incidents by dumping raw logs floods the context window and buries the signal. This Skill enforces a statistics-first workflow against VictoriaLogs so you get error rates, top streams, and error patterns before ever looking at individual log lines.

Core Features & Use Cases

  • Server-Side Statistics: Run LogsQL aggregation queries to get total counts, error rates, top streams, and normalized error patterns without transferring raw logs.
  • Strategic Log Sampling: Sample only errors, warnings, or logs around a specific incident timestamp, hard-capped at 50 entries to protect context.
  • Field Discovery: List available fields and their values to build targeted queries against unknown log schemas.
  • Use Case: An alert fires for elevated 5xx errors on the payments service. Run get_statistics.py to confirm the error rate, sample_logs.py with the errors_only strategy to see representative failures, then a targeted LogsQL query grouped by path to pinpoint the failing endpoint.

Quick Start

Ask the agent to investigate recent errors in VictoriaLogs by starting with log statistics for the affected service over the last hour.

Frequently Asked Questions about victorialogs-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query VictoriaLogs with LogsQL for incident investigation?▼

Start with get_statistics.py to get error rates and top streams via server-side aggregation, then use sample_logs.py with the errors_only strategy to see representative failures. Only run raw LogsQL queries with query_logs.py when you need a targeted filter, always with a limit or stats pipe.

How do I find which service is producing the most errors in VictoriaLogs?▼

Run a LogsQL stats query such as 'error | stats by (service) count() hits | sort by (hits) desc' through query_logs.py. The get_statistics.py script also returns the top 10 streams by volume and top normalized error patterns automatically.

Does VictoriaLogs support filtering logs around a specific timestamp?▼

Yes. Use sample_logs.py with the around_time strategy, passing an ISO timestamp via --timestamp and a window in minutes via --window. It fetches logs within that window, which is useful for investigating the moment an alert fired.

How do I discover available log fields before writing a LogsQL query?▼

Use list_fields.py to enumerate all field names, optionally scoped by a stream filter like _stream:{app="api"}. Pass --field with a field name to list its distinct values and hit counts, helping you build targeted queries.

Why should I avoid dumping raw logs during log analysis?▼

Raw log dumps flood the context window and obscure patterns. The skill enforces statistics-first investigation: aggregation queries reveal volume, error rate, and top patterns, while sampling is hard-capped at 50 entries and scripts auto-append limits to unbounded queries.

Related Skills

Explore More Software Engineering Skills→
useatriumuseatrium
4

auth-failure-log-triage

Investigate authentication and authorization failures in VictoriaLogs runtime logs.

Official
Advanced
tonone-aitonone-ai
69

vigil-incident

Diagnose production incidents by analyzing logs, metrics, and traces to identify root cause.

Official
Advanced
nirssyannirssyan

incident

Gather data from GlitchTip, Loki, Prometheus, and Kubernetes events to identify root causes.

Official
Advanced
labluplablup
672

observability

Query Backend.AI logs, metrics, and traces through the Grafana MCP during local development.

Official
Intermediate