🇯🇵 日本語

Totonoe Log

Normalize, merge, filter, collapse, and compare messy logs.

Totonoe Log is a VS Code extension for log investigation. Real-world troubleshooting means staring at multiple log files with inconsistent formats, timestamps, and noise. Totonoe Log normalizes those messy logs into a consistent, readable timeline so you can actually investigate the issue instead of fighting the format.

Every view opens as a regular read-only editor tab, so VS Code's built-in search, copy, and diff work exactly as you expect. Run the commands from the Command Palette (Ctrl+Shift+P).

Normalize into one timeline

Totonoe Log: Show Normalized View parses the log file in the active editor and re-renders every entry in a common structure, regardless of the format each line was originally written in.

Common timestamp formats are recognized out of the box: ISO 8601 (plain and bracketed), classic syslog, slash-separated dates (2024/01/02 03:04:05), Apache/Nginx access-log timestamps ([02/Jan/2024:03:04:05 +0900]), and leading epoch seconds/milliseconds. Formats not covered by the built-ins can be added via the totonoeLog.timestampFormats setting (see Custom timestamp formats).

Long silent stretches are marked, too: when the timestamp gap between consecutive entries exceeds a threshold, a "XX seconds of silence" separator line is inserted so the quiet periods stand out during an incident investigation (applies to the normalized view and the merged view, and their filtered variants; configure with totonoeLog.gap.thresholdSeconds).

Filter out the noise

Totonoe Log: Show Normalized View Filtered lets you freely combine filters in a single flow: pick the conditions you want from a multi-select list, and answer only the prompts for the conditions you picked.

• Severity — keep only error / warn / info / ...
• Date/time range — narrow down to the time window you care about
• Ignore pattern — hide entries matching a pattern. Patterns are compiled as regular expressions; plain text without special regex characters simply works as a substring match

Each condition is also available as its own command (... Filtered by Severity, ... Filtered by Date Range, ... Filtered by Date Range and Severity, ... Filtered by Ignore Pattern).

Merge multiple files

Totonoe Log: Show Merged View merges multiple log files by timestamp into a single timeline for cross-file investigation, with source file name and file "kind" columns (e.g. message_20240101.log → kind message).

You can also select two or more files in the Explorer and merge them straight from the right-click context menu (Totonoe Log: Merge Selected Files).

The merged view can be filtered too: Totonoe Log: Show Merged View Filtered picks the files to merge, then applies the same multi-select filter flow described above.

The same "XX seconds of silence" gap detection described above applies here too, spotting silent stretches across all merged source files (see Normalize into one timeline).

Logs from servers in different timezones, or from a host whose clock is off, can be corrected per file so they still merge into the true chronological order (see Timezone normalization and Clock skew correction).

Collapse repeated lines

Totonoe Log: Show Collapsed View folds consecutive repeated patterns into a single line with a repeat count (e.g. "×5"), so repetitive noise stops burying the interesting entries (threshold configurable with totonoeLog.collapse.threshold). Each collapsed line also shows the group's timestamp span (start 〜 end), so you can tell a burst that happened in seconds from one spread over hours without expanding the group.

Compare two logs

Totonoe Log: Compare Logs diffs two logs that differ in dates or hosts — without those differences flooding the diff as noise, so the real differences stand out.

Totonoe Log: Copy Masked Text copies the active editor's log text with timestamps and hosts masked, ready to paste into an external diff tool (what gets masked is configurable).

Timezone normalization

Logs written in local time without an offset (e.g. 2024-01-02 03:04:05) are interpreted as UTC by default. When servers in different timezones are involved, that skews the merged timeline. Three settings fix this:

• totonoeLog.timezone.sourceOffset — the UTC offset to assume for timestamps without explicit timezone information (default UTC). Timestamps that spell out an offset or Z, and epoch timestamps, are never shifted: what the log says always wins

• totonoeLog.timezone.fileOffsets — per-file overrides, matched against the file name (first matching rule wins):

  "totonoeLog.timezone.fileOffsets": [
    { "filePattern": "tokyo-.*\\.log", "offset": "+09:00" },
    { "filePattern": "nyc-.*\\.log", "offset": "-05:00" }
  ]
  

• totonoeLog.timezone.display — the timezone every view renders timestamps in: UTC (default, Z suffix), local (this machine's timezone, DST-aware), or a fixed offset such as +09:00 (rendered as 2024-01-02T12:04:05.000+09:00)

Timezone auto-detection is not implemented: a timestamp without an offset carries no reliable signal to detect one from, so guessing would silently corrupt the timeline instead of tidying it.

Clock skew correction

Timezone settings can't help when a host's clock itself is wrong — say, a server drifting 40 seconds ahead because NTP is broken. The totonoeLog.clockSkew.fileOffsets setting corrects such logs by ±N seconds, per file-name pattern (first matching rule wins):

"totonoeLog.clockSkew.fileOffsets": [
  { "filePattern": "app-server\\.log", "offsetSeconds": -40 },
  { "filePattern": "db-.*\\.log", "offsetSeconds": 2.5 }
]

Unlike totonoeLog.timezone.sourceOffset, the correction applies to every recognized timestamp — including ones with an explicit offset, Z, or epoch form — because the clock that produced them was itself off. Merged and normalized/filtered/collapsed views sort, display, and date-filter by the corrected times. The raw log text is never rewritten, and the compare view is unaffected (it masks timestamps entirely). Invalid entries are skipped with a warning; the remaining rules keep working.

Custom timestamp formats

If your logs use a timestamp format the built-ins don't recognize, add it with the totonoeLog.timestampFormats setting. Each entry is a regular expression whose named capture groups tell Totonoe Log how to interpret the match. Custom formats are tried before the built-in ones, so they can also override a built-in interpretation. Patterns are automatically anchored to the start of the line.

"totonoeLog.timestampFormats": [
  {
    "name": "jp-date",
    "pattern": "(?<y>\\d{4})年(?<mo>\\d{1,2})月(?<d>\\d{1,2})日 (?<h>\\d{1,2}):(?<mi>\\d{2}):(?<s>\\d{2})"
  }
]

Supported capture groups:

• Calendar style: y mo d h mi s (all required), plus optional ms (fractional seconds), tzs tzh tzm (offset sign/hours/minutes), and tzz (a literal Z meaning explicit UTC). Without an offset the timestamp is interpreted as UTC, or as totonoeLog.timezone.sourceOffset when that setting is configured
• Epoch style: epochMs (epoch milliseconds) or epochSec (epoch seconds, with an optional ms group for the fractional part)

Invalid entries (bad regex, missing groups) are skipped with a warning; the remaining formats keep working.

Installation

Download totonoe-log.vsix from the GitHub Releases page and install it:

code --install-extension totonoe-log.vsix

or run Extensions: Install from VSIX... from the Command Palette.

Settings

All settings live under the totonoeLog namespace.

The Totonoe series

Totonoe Log is the first of a planned "Totonoe" series: small VS Code extensions, each built around tidying up (整える, totonoeru) some kind of messy input.

License

MIT