Command Reference

Kafka Log Analyzer complete command reference

/kafka-analyze

Parse Kafka logs, extract events, and detect anomalies.

Syntax

/kafka-analyze [options]

Options

Option	Type	Default	Description
--source	file | paste | exporter | loki	-	Data source type (required)
--path	string	-	Log file path (required when source=file)
--cluster	string	-	Cluster name (for exporter/loki sources)
--query	string	-	LogQL query expression (for loki source)
--limit	number	1000	Max log lines (for loki source)
--focus	string[]	-	Focus area filter, comma-separated
--timeline	string	-	Time window: 1m, 5m, 15m, 1h, 6h, 1d
--priority	string[]	-	Filter anomalies by priority: P0, P1, P2, P3 (comma-separated)
--report	markdown | json | slack | folded-markdown	markdown	Output format
--template	string	-	Diagnostic template ID (e.g. lag-diagnosis)
--interactive	flag	off	Launch interactive TUI browser (-i)
--locale	en | zh	auto	Set language (-l)
--debug	flag	off	Enable debug logging

Examples

Analyze Log File

/kafka-analyze --source file --path /var/log/kafka/server.log

Paste Log Analysis

/kafka-analyze

[2026-01-15 10:00:01] ERROR [producer] Failed to send record to topic orders
[2026-01-15 10:00:02] WARN  [consumer] lag exceeded threshold (5000 messages)

Analyze from Kafka Exporter

/kafka-analyze --source exporter --cluster production

Fetches real-time metrics from Prometheus/Kafka Exporter and detects anomalies from lag data.

Analyze from Loki

/kafka-analyze --source loki --cluster production --limit 500

Queries Kafka logs from Loki via LogQL, then reuses the Python analysis pipeline.

Specify Focus Areas

/kafka-analyze --source file --path server.log --focus producer,error

Available focus areas:

• producer — Producer-related events
• consumer — Consumer-related events
• broker — Broker-related events
• lag — Consumer Lag-related
• error — Errors and exceptions

Specify Time Window

/kafka-analyze --source file --path server.log --timeline 1h

JSON Output

/kafka-analyze --source file --path server.log --output json

---

/kafka-lag

Get Consumer Lag metrics from Prometheus / Kafka Exporter.

Requires PROMETHEUS_URL environment variable to be configured

Syntax

/kafka-lag [options]

Options

Option	Type	Description
--cluster	string	Cluster name (optional)
--group	string	Consumer group name (optional)
--topic	string	Topic name (optional)

Examples

Query All Consumer Groups Lag

/kafka-lag

Query Specific Cluster and Consumer Group

/kafka-lag --cluster production --group order-processor

Query Specific Topic

/kafka-lag --topic orders

---

CLI Commands

For use outside Claude Code, the CLI provides direct access:

# Analyze log file
npx kafka-log-analyze analyze server.log --focus producer,error

# Paste log content via stdin
cat error.log | npx kafka-log-analyze analyze-paste

# Fetch consumer lag from Prometheus
npx kafka-log-analyze lag --cluster production --group order-processor

# Analyze from Kafka Exporter
npx kafka-log-analyze analyze-exporter --cluster production

# Analyze from Loki
npx kafka-log-analyze analyze-loki --cluster production --limit 500

# Start hook server for Grafana/PagerDuty alerts (v0.4.0+)
npx kafka-log-analyze hooks --port 3100

# Test push integration (v0.4.0+)
npx kafka-log-analyze push-test --target feishu

# Generate shell completion script (v1.1.0+)
npx kafka-log-analyze completion bash > /etc/bash_completion.d/kafka-log-analyze

# List diagnostic templates (v1.1.0+)
npx kafka-log-analyze templates

# Analyze with a diagnostic template (v1.1.0+)
npx kafka-log-analyze analyze server.log --template lag-diagnosis

# Interactive TUI browser (v1.1.0+)
npx kafka-log-analyze analyze server.log --interactive

# Use Chinese locale (v1.1.0+)
npx kafka-log-analyze analyze server.log --locale zh

---

Hook Server (v0.4.0+)

The hook server listens for Grafana/PagerDuty webhook alerts, auto-triggers analysis, and pushes results to configured targets (Feishu/Slack/JIRA).

Endpoints

Method	Path	Description
POST	/hooks/grafana	Receive Grafana unified/legacy alert webhooks
POST	/hooks/pagerduty	Receive PagerDuty Events API v2 alerts
GET	/hooks/health	Health check endpoint

Start the Server

# Start on default port (GRAFANA_WEBHOOK_PORT or 3100)
npx kafka-log-analyze hooks

# Start on a custom port
npx kafka-log-analyze hooks --port 3200

Incoming alerts are deduplicated by fingerprint within the configured TTL window (HOOK_DEDUP_WINDOW_MS, default 5 minutes) and merged up to HOOK_MAX_MERGE_COUNT before triggering analysis.

Push Test

# Test Feishu push
npx kafka-log-analyze push-test --target feishu

# Test Slack push
npx kafka-log-analyze push-test --target slack

# Test all configured targets
npx kafka-log-analyze push-test --target all

---

MCP Tools

In addition to slash commands, you can directly invoke MCP Tools.

analyze_log

{
  "tool": "analyze_log",
  "input": {
    "source": "file",
    "path": "/var/log/kafka/server.log",
    "focus": ["producer", "error"],
    "timeline": "1h",
    "priority": ["P0", "P1"],
    "report": "markdown"
  }
}

Exporter source:

{
  "tool": "analyze_log",
  "input": {
    "source": "exporter",
    "cluster": "production"
  }
}

Loki source:

{
  "tool": "analyze_log",
  "input": {
    "source": "loki",
    "cluster": "production",
    "limit": 500
  }
}

get_lag

{
  "tool": "get_lag",
  "input": {
    "cluster": "production",
    "consumer_group": "order-processor"
  }
}

Returns structured consumer lag data. When Prometheus is unavailable, returns empty results with a warning field.

---

Related Documentation

• Configuration — Environment variables and data source configuration
• API Reference — Complete MCP Tools API documentation