Logmorph documentation

Compare two log snapshots. Inspect what changed. Keep a reviewable evidence trail.

Start an investigation

1. Open the workspace and choose New investigation.
2. Add baseline logs from before a change, then candidate logs from after it. Choose files, drop them, or paste their contents.
3. Compare similar time windows for the same service. Optionally name the investigation and service.
4. Choose Compare logs. Select a pattern to see counts, event shares, and exact source lines. Navigate between occurrences or open the full source.
5. Use Log explorer to search every source line, filter by service or severity, and jump to a line number.
6. Keep or dismiss patterns and write notes. Choose Save locally to preserve the investigation in this browser.

Saved investigations appear in the workspace. Notes, status, names, and review decisions then save automatically. The save indicator confirms completion.

Export and restore

Export a Markdown report for an incident thread, a structured JSON report for another tool, or a portable investigation backup. Only the portable backup can be restored into Logmorph. It includes both complete source files, notes, and review decisions. Choose Restore backup to reopen it, then Save locally to keep it.

Supported logs

Each file can contain up to 5 MB and 50,000 source lines. UTF-8 plain text and one JSON object per line (JSONL) are supported. JSON arrays, compressed archives, and binary files are not.

2026-11-01T14:00:00Z INFO request completed status=200
2026-11-01T14:00:01Z ERROR connection pool exhausted
    at acquireConnection (pool.js:41)

{"timestamp":"2026-11-01T14:00:01Z","level":"ERROR",
 "service":"backend-service","message":"connection pool exhausted"}

JSON fields include message/msg/body, level/severity/severityText, timestamp/time/@timestamp, and service/service_name. Numeric OpenTelemetry severityNumber is supported. Common indented stack frames stay attached to the preceding event. Malformed JSON is retained as text. Unrecognized severity is shown as UNKNOWN, not inferred from a structured message's prose.

How comparison works

The current workspace uses deterministic message normalization and frequency comparison. It does not run an AI model or diagnose a root cause.

1. Group messages by service, severity, and normalized text. Recognized timestamps, UUIDs, IP addresses, request identifiers, release identifiers, and durations are replaced. HTTP status codes and most other numbers remain distinct.
2. Calculate each pattern's count and its share of all events in the file.
3. Flag a WARN or ERROR pattern when it is new, or its event share is at least twice the baseline share with at least three additional occurrences.

The Changed view also shows new informational patterns, resolved patterns, and decreases of at least half the event share with at least three fewer occurrences. All patterns includes stable patterns and UNKNOWN severity. The first 500 matching patterns are shown; narrow the search to inspect more.

Event share is not a request error rate. Traffic, time windows, sampling, or log verbosity can change the denominator. A flagged change is a clue to investigate. No flagged patterns does not establish that a service is healthy. Normalization can merge different events or leave related events separate; always inspect the source.

Data & privacy

Log parsing and comparison run on this device in a browser worker. Log contents are not uploaded, sent to an AI provider, or collected by analytics. The site serves its own font and application assets.

Unsaved work remains in memory until the page closes or another investigation replaces it. Save locally writes both original files, notes, and decisions to IndexedDB on this browser and origin. There are no user accounts, cloud backups, or multi-device sync. Clearing browser data or using a private browsing session can remove saved work. Use exported backups for work you need to retain.

Anyone with access to this browser profile may be able to open locally saved investigations. Exports include raw log contents, so review them before sharing. Data & privacy in the workspace lets you delete all locally saved investigations; individual investigations can be deleted from the list with confirmation. The original files on disk are unaffected.

What's available today

Available: local file comparison, exact source context, occurrence navigation, full-source search, severity and service filters, local saved investigations, notes, review decisions, and report/backup exports.

In development: small log-native models running on CPUs inside customer clouds; learning normal patterns and new formats from unlabeled logs; using engineer feedback as training signal; model update evaluation against past incidents; versioning and rollback. The current workspace does not connect to production log streams or train models from review decisions.

The system we're building

Logmorph's goal is to catch novel behavior before it becomes a page, then present a short, cited evidence trail for engineers and AI agents. Continuous learning needs explicit release gates: evaluate against historical incidents, measure regressions, ship a versioned update, monitor it, and retain a path to the previous version. These are design commitments, not completed cloud features.

The founding team is Karan Bhukar and Varun Sahni. Karan's research on distribution shift, out-of-distribution coverage, BERTOps, and reinforcement learning informs the learning system. Varun's work on Code Buddy informs the detect, fix, and verify workflow.