Compress earthy log lines into structural patterns pinch statistics, anomalies, and correlations.
Turn millions of noisy log lines into a fistful of actionable patterns — pinch typed variables, quantile stats, anomaly flags, and severity scoring. Runs arsenic a CLI, successful the browser via WASM, aliases arsenic a Rust library.
$ feline server.log | ctrlb-decompose
┌────────────────────────────────────────────────────────────────────┐
│ ctrlb-decompose: 1,247,831 lines -> 43 patterns (99.9% reduction) │
└────────────────────────────────────────────────────────────────────┘
#1 [ERROR] ██████████████████████ 18,402 (1.5%)
<TS> ERROR [<*>] Connection to <ip> timed retired aft <duration>
ip IPv4 unique=12 top: 10.0.1.15 (34%), 10.0.1.22 (28%)
long Duration p50=120ms p99=4.8s
#2 [INFO] ████████████████████ 904,221 (72.5%)
<TS> INFO [<*>] Request from <ip> completed successful <duration> status=<status>
ip IPv4 unique=1,847 top: 10.0.1.15 (12%), 10.0.1.22 (8%)
long Duration p50=23ms p99=312ms
position Enum unique=3 values: 200 (91%), 404 (6%), 500 (3%)
Website coming soon.
ctrlb-decompose uses a two-stage normalization and clustering pipeline that processes logs successful a azygous streaming walk pinch minimal representation footprint.
┌──────────────────────────────────────────────┐
│ ctrlb-decompose pipeline │
└──────────────────────────────────────────────┘
Raw Log Lines
│
▼
┌──────────────┐ Strip & parse timestamps (ISO 8601, Apache,
│ Timestamp │ syslog, Unix epoch, etc.) into normalized
│ Extraction │ <TS> markers pinch DateTime values.
└──────┬───────┘
│
▼
┌──────────────┐ Replace integers, floats, IPs, and strings
│ CLP │ pinch compact placeholder bytes. Structurally
│ Encoding │ identical lines now nutrient the aforesaid "logtype."
└──────┬───────┘
│
▼
┌──────────────┐ Tree-based similarity clustering (Drain3) groups
│ Drain3 │ logtypes into patterns. Differing tokens become
│ Clustering │ <*> wildcards. Incremental — nary 2nd walk needed.
└──────┬───────┘
│
▼
┌──────────────┐ Merge CLP-decoded values pinch Drain3 wildcard
│ Variable │ positions. Classify each adaptable into semantic
│ Extraction │ types: IPv4, UUID, Duration, Enum, Integer, etc.
│ & Typing │
└──────┬───────┘
│
▼
┌──────────────┐ DDSketch quantiles (p50/p99), HyperLogLog
│ Statistics │ cardinality estimation, top-k values, temporal
│ Accumulation │ bucketing, and reservoir-sampled illustration lines.
└──────┬───────┘
│
▼
┌──────────────┐ Frequency spikes, correction cascades, low-cardinality
│ Anomaly │ flags, bimodal distributions, and clustered
│ Detection │ numeric detection.
└──────┬───────┘
│
▼
┌──────────────┐ Keyword-based severity (ERROR > WARN > INFO > DEBUG),
│ Scoring │ temporal co-occurrence, shared adaptable correlation,
│ & Correlation│ and correction cascade discovery crossed patterns.
└──────┬───────┘
│
▼
┌──────────────┐
│ Output │──── Human (ANSI terminal) / LLM (compact markdown) / JSON
└──────────────┘
CLP (Compressed Log Processor) encoding normalizes adaptable tokens into typed placeholders, truthful structurally identical lines nutrient identical logtypes sloppy of the existent values:
Input: "Request from 10.0.1.15 completed successful 45ms status=200"
Logtype: "Request from <dict> completed successful <float>ms status=<int>"
Stage 2 — Drain3 Clustering
The Drain algorithm builds a prefix character complete logtypes and groups them by token similarity (configurable threshold, default 0.4). Where tokens diverge, the template gains a <*> wildcard. This runs incrementally — each statement is processed erstwhile pinch nary 2nd pass.
Extracted variables are classified into semantic types for richer analysis:
Type
Example
Detection
| IPv4 / IPv6 | 10.0.1.15 | CIDR shape match |
| UUID | 550e8400-e29b-... | 8-4-4-4-12 hex format |
| Duration | 45ms, 3.2s | Numeric + clip portion suffix |
| HexID | 0x1a2b3c | 4+ hex digits |
| Integer | 200 | Parses arsenic i64 |
| Float | 3.14 | Contains ., parses arsenic f64 |
| Enum | ERROR | Low cardinality (<=20 unique, top-3 >= 80%) |
| Timestamp | 2024-01-15T14:22:01Z | RFC 3339 pattern |
| String | anything else | Fallback |
- Drain3 clusters: O(k) pinch LRU eviction (default 10k max)
- Quantiles: DDSketch — fixed ~200 bytes per numeric slot, nary earthy worth storage
- Cardinality: HyperLogLog++ — ~200 bytes per high-cardinality variable
- Examples: Reservoir sampling — bounded buffer per pattern
brew pat ctrlb-hq/tap
brew instal ctrlb-decompose
curl -LO https://github.com/ctrlb-hq/ctrlb-decompose/releases/download/v0.1.0/ctrlb-decompose_0.1.0-1_amd64.deb
sudo dpkg -i ctrlb-decompose_0.1.0-1_amd64.deb
git clone https://github.com/ctrlb-hq/ctrlb-decompose.git cd ctrlb-decompose
cargo build --release # Binary astatine target/release/ctrlb-decompose
# Pipe from stdin cat /var/log/syslog | ctrlb-decompose # Read from file ctrlb-decompose server.log # LLM-optimized output (compact, token-efficient) ctrlb-decompose --llm app.log # JSON output ctrlb-decompose --json app.log # Top 10 patterns pinch 3 illustration lines each ctrlb-decompose --top 10 --context 3 app.log
ctrlb-decompose [OPTIONS] [FILE]
Arguments:
[FILE] Log record way (reads stdin if omitted aliases "-")
Options:
--human Human-readable output pinch colors (default)
--llm LLM-optimized compact markdown
--json Structured JSON output
--top <N> Show apical N patterns (default: 20)
--context <N> Example lines per shape (default: 0)
--no-color Disable ANSI colors
--no-banner Suppress header/footer
-q, --quiet Suppress advancement messages
-h, --help Show help
-V, --version Show version
Format
Flag
Best for
| Human | --human (default) | Terminal investigation — colored, ocular bars |
| LLM | --llm | Feeding into LLMs — compact, token-efficient markdown |
| JSON | --json | Programmatic depletion — structured, machine-readable |
Use ctrlb-decompose straight from Claude Code — nary CLI knowledge needed. The plugin installs ctrlb-decompose automatically and lets you analyse logs conscionable by asking.
/plugin marketplace adhd ctrlb-hq/ctrlb-decompose
/plugin instal ctrlb-decompose@ctrlb-hq
Just picture what you want successful plain language:
- "Analyze the errors successful /var/log/app.log"
- "What are the astir communal patterns successful this log file?"
- "Summarize these logs and item anomalies"
Claude will cheque if ctrlb-decompose is installed (and locomotion you done installation if not), tally the analysis, and explicate the results — surfacing errors first, calling retired anomalies, and suggesting what to analyse next.
See plugin/README.md for afloat details.
MIT
English (US) · 
Indonesian (ID) ·