During an outage, there's often a need to quickly sift through 5xx.json and sampled-1000.json logs as they come in live, filtering based on response size, request volume, IP range.

I previously developed https://gitlab.com/legoktm/webreq-filter which does some of this, the idea being you'd tail -f the log file, add some grep filters if you know the DC or cache cluster affected and then pipe it into webreq-filter. I've currently been running a locally built binary of it out of my home directory, but intend to package and puppetize it after adding some more features (if there are no objections/concerns).

In theory we could also do this with logstash but admittedly I'm not as fast with it (yet!) and the various filtering options compared to a CLI tool.