Python Multi-Log Merge and Timeline Correlator Prompt
Build a Python tool that merges several log files with different timestamp formats into one time-ordered timeline, tags each line with its source, and correlates events across services for incident analysis
- Target user
- Engineers building log-analysis and incident-triage automation in Python
- Difficulty
- Advanced
- Tools
- Claude, ChatGPT, Cursor
The prompt
You are an incident responder who reconstructs what happened by stitching logs from several services into one timeline, and you build a tool that does it correctly across mismatched timestamp formats and time zones. I will provide: - The log files to merge and each file's timestamp format (or a note that it must be auto-detected) - The time zone of each source and the target time zone for the merged timeline - Optional filters: a time window, severity threshold, or a correlation key (request ID, trace ID) to follow across services Your job: 1. **Parse timestamps robustly** — support per-file strptime formats and common ISO-8601 variants, normalize every line to timezone-aware UTC, and handle lines with no parseable timestamp (attach them to the previous timestamped line as a continuation, e.g. multi-line tracebacks). 2. **Merge efficiently** — stream files line by line and merge with a heap/`heapq.merge` on timestamp rather than loading everything into memory, so multi-gigabyte logs work. 3. **Tag provenance** — prefix or annotate every emitted line with its source file/service so the merged timeline is unambiguous. 4. **Correlate** — when given a correlation key (request/trace ID), filter the timeline to just the events carrying that key across all sources, preserving order. 5. **Window and filter** — support a `--since/--until` window and a minimum severity, applied during the streaming merge. 6. **Output** — emit a clean, aligned, time-ordered timeline for humans and optional JSONL for further processing. 7. **Test** — pytest cases for mixed timestamp formats, time-zone normalization, multi-line continuation, and correlation-key filtering. Output as: (a) the per-source parser/normalizer, (b) the heap-based streaming merger, (c) the CLI with window/severity/correlation filters, (d) the pytest suite. Bias toward: timezone-aware UTC normalization, streaming/heap merge over in-memory sort, correct multi-line record handling, and unambiguous source tagging.
Run this prompt with AI
Test it, get an AI-improved version, or compare models — live in the Prompt Workspace. No copy-paste.
Related prompts
-
Python Prometheus Pushgateway Batch-Job Metrics Reporter Prompt
Build a Python module that reports batch-job and cron metrics (success, duration, records processed, last-success timestamp) to a Prometheus Pushgateway with correct grouping keys and failure-safe pushing
-
Python logging.config dictConfig Setup Prompt
Configure Python's logging via a single declarative dictConfig dictionary with multiple handlers, formatters, and per-module log levels instead of scattered basicConfig calls
-
Bash Leveled Logging Library Prompt
Build a small, sourceable Bash logging library with DEBUG/INFO/WARN/ERROR levels, timestamps, TTY-aware color, and a LOG_LEVEL threshold — so your scripts emit consistent, greppable output to stderr.
-
Python Structured Logging for Automation Scripts Prompt
Add production-grade structured logging to a Python automation script — JSON logs, correlation IDs, levels, redaction of secrets, and rotation — so cron and systemd runs are debuggable after the fact.
More Bash & Python Automation prompts & error guides
Browse every Bash & Python Automation prompt and troubleshooting guide in one place.
Reading prompts? Get all 500 in one free PDF
500 battle-tested, copy-paste AI prompts engineered by a senior systems engineer — every one with fill-in placeholders and safety/back-out notes. Drop your email and it's yours.
- 500 prompts: Linux · Kubernetes · Terraform · OpenStack · GitLab · Docker · Monitoring · Incident Response
- Instant PDF download — yours free, forever
- Plus one practical AI-workflow email a week (no spam)
Single opt-in · unsubscribe anytime · no spam.