nimble-triage

Pipe your logs through a local decision model. Every entry gets a severity, a category and a needs-attention flag, computed by Nimble through Ollama's /v1/systemone endpoint. No API key is required. By default, logs are sent only to Ollama running on your own machine.

$ nimble-triage --format pretty app.log
  error     auth        0.06  ERROR auth: invalid password for user alice@example.com
! warning   network     1.00  WARN tls: certificate for api.example.com expires in 3 days
  info      other       0.05  INFO http GET /health 200 2ms
  error?    application 0.11  ERROR payment-worker: retry 1/5 failed, retrying in 2s
! critical  database    1.00  CRITICAL kernel: Out of memory: Killed process 4121 (postgres)
5 entries, 2 need attention

! marks entries that meet the attention threshold. The number is the model's attention score, and ? marks a severity confidence below 0.6. Scores help rank entries but should not be interpreted as calibrated guarantees.

Requirements

• Python 3.10 or newer

• Ollama 0.35.0 or newer (the first release with /v1/systemone)

• The Nimble model, about a 9 GB download (16 GB of RAM recommended):

  ollama pull nimble
  

Install

pipx install nimble-triage    # recommended for command-line tools
# or
pip install nimble-triage

nimble-triage has no dependencies outside the Python standard library.

Usage

# Full classification
nimble-triage application.log                  # JSON Lines to stdout
nimble-triage -f pretty app.log                # aligned, coloured output
nimble-triage -f pretty -a app.log             # only entries that need attention
tail -f app.log | nimble-triage -f pretty -a   # live
grep -v DEBUG app.log | nimble-triage          # pre-filter to save time
nimble-triage app.log | jq 'select(.needs_attention)'
nimble-triage --continue-on-error app.log      # keep going after failed entries

# Faster attention classification
nimble-triage --mode attention application.log

# Full classification, but print only flagged entries
nimble-triage --flagged-only application.log

# Fast classification and print only flagged entries
nimble-triage --mode attention --flagged-only application.log

JSON Lines output

One object per non-blank input line:

{"severity": "warning", "severity_confidence": 0.9624, "category": "network", "category_confidence": 0.94, "attention_probability": 0.9996, "needs_attention": true, "line": "WARN tls: certificate for api.example.com expires in 3 days"}

• severity: one of debug, info, warning, error, critical
• category: one of auth, database, network, performance, security, application, other
• *_confidence, attention_probability: numbers between 0 and 1
• needs_attention: attention_probability >= --threshold

Severity and needs-attention are separate judgements: a certificate that expires in three days is only a warning but needs a human, while a single failed login is an error that does not.

Attention mode output

--mode attention sends only the needs-attention question to Nimble instead of all three questions. Use it when severity and category are not required.

{"attention_probability": 0.9996, "needs_attention": true, "line": "WARN tls: certificate expires in 3 days"}

Exit codes

By default, nimble-triage stops on the first model or response error. Use --continue-on-error for long streams where partial results are preferable. Errors are written to stderr, successful results remain on stdout, and the command exits with code 1 if any entry failed.

How it works

Each log line is sent to Ollama's /v1/systemone endpoint together with three typed questions: two choice questions (severity and category) and one noul (yes/no) question (needs attention). Nimble is a decision model: rather than generating text, it scores the options and returns probabilities. The wording of the questions lives in questions.py and is the main lever on accuracy.

Privacy

Log entries are sent only to the Ollama server selected by --host or OLLAMA_HOST. The default is http://localhost:11434, which keeps requests on the local machine. If you configure another hostname, your logs are transmitted to that server. Use HTTPS and review logs for credentials or personal data before sending them to a remote host.

Limits

• Speed: each line is one model call, roughly 1 to 3 seconds per line on an Apple M4 with 16 GB. nimble-triage is intended for tens to hundreds of entries, not entire log archives. Filter large inputs before processing. Use --mode attention when severity and category are not required. It sends one model question per entry instead of three and can substantially reduce processing time.
• Independent entries: each non-blank line is classified independently. Multiline stack traces and surrounding log context are not grouped together.
• Long lines: entries are cut to their first 8,000 characters before being sent to Ollama.
• Uncalibrated scores: confidence and attention scores are model outputs, not guarantees of correctness. Tune --threshold against representative logs before relying on it.
• Human review: use the results to decide what to inspect first. Do not use nimble-triage as the only source for alerting, security decisions, or incident response.

Development

git clone https://github.com/GauravGupta035/nimble-triage
cd nimble-triage
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest    # runs without Ollama

License

MIT