logsite

Find the line of code behind every production error, noisy log line and failing test.

logsite reads your code and the logs you already have (Loki, OpenSearch / Elasticsearch, CloudWatch or a file), maps every log line back to the code that wrote it, and turns thousands of stack traces into a few causes, each pointing at your line of code. It remembers every error, so a regression comes with the fix that worked last time, and it gives AI coding assistants the same production context. No SDK, no agent in your services. Python, Java and Go.

Thousands of stack traces, a few causes

logsite errors groups production errors by cause (the exception chain and the frames in your code). IDs, timestamps and framework frames don't split a group; new and spiking come first.

820 errors in the last 24h · 3 group(s) · 3 new · before: 0

  #  TREND  COUNT  ERROR                                         RAISED AT                 LOGGED AT
  1  new      400  IllegalStateException: Shipping label reque…  CarrierApiClient.java:58  —
  2  new      400  Record processing failed topic=shipment-eve…  —                         ShipmentEventListener.java:91
  3  new       20  Consumer lag increasing group=shipment-proc…  —                         ShipmentEventListener.java:96

━━ 1. IllegalStateException: Shipping label request failed ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 400 new
   Root cause   SocketTimeoutException: Read timed out  (java.net)
   Chain        ListenerExecutionFailedException › IllegalStateException › ResourceAccessException › SocketTimeoutException
   Raised at    src/main/java/com/example/shipping/CarrierApiClient.java:58  requestLabel()
                58 │ return restTemplate.postForObject(carrierUrl + "/labels", request, LabelResponse.class);
   Call path    ShipmentEventListener.consume › ShipmentProcessor.process › CarrierService.createLabel › CarrierApiClient.requestLabel › java.net
   Example      logsite trace tr-6e6948

The incident, and what changed before it

logsite investigate links the groups that belong together and finds the deploy and the commit behind them:

━━ Incident 1 · since 19:22 UTC (60 min) · 820 errors · 3 group(s) ━━━━━━━━━━━━━━━━━━━━━━━━━ new
   Cause        IllegalStateException: Shipping label request failed  (400)
   Root cause   SocketTimeoutException: Read timed out  (java.net)
   Raised at    src/main/java/com/example/shipping/CarrierApiClient.java:58
   Then         19:22  Record processing failed topic=shipment-events …  (400)  new  started together
                19:22  Consumer lag increasing group=shipment-processor …  (20)  new  started together
   Deploy       v1.4 at 2026-10-17 19:18 UTC, 4 min before it started
   Suspects     854fbb95 2026-10-17 Maya: Lower carrier read timeout to 3s

When the same error was fixed before, the history says so, with the commit that fixed it, so the new suspect is easy to judge:

   History      ↩ came back · seen 3 Aug 2026 → 3 Sep 2026, gone after v1.3
   Fixed by     41bdce40 2026-09-03 Maya: Retry carrier timeouts with backoff

logsite investigate --report ranks the explanations (the change, more traffic, a failing dependency, a pool or a limit running out) with the evidence for and against each, including the warnings logged in the same requests, and the next check to tell them apart. A benchmark of incidents with known causes runs on every build. Spikes are measured as rates, so a busy day isn't an incident. logsite errors --since-deploy $TAG --fail-on-new turns it into a CI gate that stops a bad release.

Failing tests, for you and your AI assistant

logsite agent -- pytest (or go test, mvn test, npx jest, vitest, tsc…) runs the command and prints the causes instead of hundreds of lines, then what changed after each fix:

$ logsite agent -- pytest
pytest: 30 failed, 12 passed · 2 cause(s) · exit 1

1. 27 test(s)  sqlite3.OperationalError: no such column: discount_code
   raised   app/orders/repository.py:10 in get()
2. 3 test(s)  AssertionError: assert total(<n>) == <n>
   raised   tests/test_tax.py:4 in test_tax_0()

$ logsite agent -- pytest          # after fixing the first one
pytest: 3 failed (was 30), 39 passed · 1 cause(s) · exit 1
✓ fixed   sqlite3.OperationalError: no such column: discount_code  (27 test(s))

Production context for your AI assistant

Before Claude Code (or any MCP client) changes a function, production_context tells it what that code does in production, so it doesn't undo an earlier fix. logsite about is the same in the terminal:

$ logsite about src/main/java/com/example/shipping/CarrierApiClient.java:58
  errors in the last 24h:
        660  java.lang.IllegalStateException: Shipping label request failed  (raised here, back)
             root cause: java.net.SocketTimeoutException: Read timed out
             ↩ came back: gone after v1.3, fixed by 41bdce40 Retry carrier timeouts with backoff
  last changed:
    0df4dac1  2026-10-18  Maya: Lower carrier read timeout to 3s
    41bdce40  2026-09-03  Maya: Retry carrier timeouts with backoff

The Claude Code plugin sets it all up: the MCP server, a hook that runs the assistant's tests through agent mode, and /logsite:investigate, /logsite:fix-error and /logsite:log-cost:

/plugin marketplace add rajpaynaik/logsite
/plugin install logsite@logsite

And more

• In your editor: production counts above every log call (1.2M in 24h, ▲ 8.0x), the line that raised an error marked with how often it did, and log-quality warnings as you type. VS Code, or any LSP editor with logsite serve.
• Cost per line of code: which logger.info(...) calls make up your log bill. → Cost and leaks
• Grafana: a logsite data source under Connections (error groups, incidents, ranked explanations), a generated dashboard of cost and errors per code line, with "back after a fix" markers on the graphs; the error summary in your alert notifications (Slack / webhook); Alloy rules that drop or sample noisy lines before they're shipped; one Docker container. → Grafana, alerts and Alloy
• Lint for logging: lost stack traces, failures logged at info, secrets and card numbers in log calls, logs in hot loops, missing context like request_id. → Lint rules
• History: "seen before, fixed by a1b2c3d in v1.3, back since v1.4": logsite remembers every error group, so a regression comes with the fix that worked last time. → History
• Leaks: secrets and personal data that actually reached production logs, per log call.
• Request timeline: logsite trace <id>, every line of one request across services.
• MCP server: AI assistants ask "what's failing in production, and why?" and get the incidents, groups and code lines. → MCP server

Install

pip install logsite                # the command-line tool
pip install "logsite[lsp,mcp]"     # + the editor language server and the MCP server
pipx install "logsite[lsp]"        # once for your user, e.g. for Java and Go projects

Quick start

cd your-service
logsite lint                       # logging problems in the code, no backend needed
logsite agent -- pytest            # failing tests grouped by cause

# point it at your logs: logsite.toml
cat > logsite.toml <<'TOML'
[backend]
type = "loki"
url = "http://localhost:3100"
selector = '{service_name="checkout"}'
TOML

logsite errors                     # production errors grouped by cause
logsite investigate                # ... linked into incidents, with the deploy and commits
logsite about app/checkout.py:42   # what production says about this code, before you change it
logsite sync --backfill 30d        # fill the history: seen before, fixed by, came back
logsite cost --price-per-gb 0.5    # what each log call costs per month

Supported

Documentation

Commands · Configuration · Errors, incidents and the CI gate · Agent mode · History · Grafana, alerts and Alloy · Languages · Lint rules · Cost and leaks · Request timeline · MCP server · Claude Code plugin · How it works · Roadmap

Status

Early (0.x): feedback and contributors welcome. Formerly loglens: loglens.toml and [tool.loglens] configs keep working. See CONTRIBUTING.md; a new log backend is a good first PR.

License

MIT