---
name: logs
description: Tail and search service logs with filtering
argument-hint: "[service|--search pattern|--errors]"
---

# Log Viewer

Tail and search logs across trading platform services.

## Usage

- `/logs` - Tail all services (last 100 lines)
- `/logs api` - Tail specific service
- `/logs --errors` - Show only errors across all services
- `/logs --search "order.*failed"` - Search with regex
- `/logs api --since 1h` - Logs from last hour
- `/logs --level error` - Filter by log level
- `/logs executor --follow` - Live tail (follow mode)

## Services

| Service | Container | Log Path |
|---------|-----------|----------|
| api | trading-api | stdout |
| ui | trading-ui | stdout |
| executor | trading-executor | stdout |
| risk | trading-risk | stdout |
| worker | trading-worker | stdout |
| ml-server | ml-server | stdout |
| market-ingest | market-ingest | stdout |
| backtester | backtester | stdout |

## Instructions

When this skill is invoked:

1. Parse arguments:
   - Service name: Filter to specific service
   - `--errors`: Filter `level=error` or `level=ERROR`
   - `--search <pattern>`: Grep with regex pattern
   - `--since <duration>`: Time filter (1h, 30m, 1d)
   - `--level <level>`: Filter by log level
   - `--follow` / `-f`: Live tail mode
   - `--lines N` / `-n N`: Number of lines (default 100)

2. For Docker Compose (dev):
   ```bash
   # Single service
   docker compose logs $SERVICE --tail $LINES $FOLLOW_FLAG

   # All services with grep
   docker compose logs --tail $LINES | grep -E "$PATTERN"

   # Errors only
   docker compose logs --tail 500 | grep -iE "error|exception|failed|traceback"
   ```

3. For Kubernetes (staging/prod):
   ```bash
   # Single pod
   kubectl logs -l app=$SERVICE -n trading --tail=$LINES $FOLLOW_FLAG

   # With stern for multi-pod
   stern $SERVICE -n trading --since $SINCE
   ```

4. Display formatted output:
   ```
   [09:31:05] api       INFO   Request: POST /orders
   [09:31:05] executor  INFO   Order received: abc123
   [09:31:06] executor  ERROR  Order failed: insufficient margin
   [09:31:06] risk      WARN   Margin utilization at 95%
   ```

5. For `--errors`, highlight and summarize:
   ```
   ERROR SUMMARY (last 1h)
   ─────────────────────────────────────────────────────────
   executor    12 errors   "insufficient margin" (8), "timeout" (4)
   api         3 errors    "validation failed" (3)
   ml-server   1 error     "model not found" (1)

   Most recent errors:
   [09:31:06] executor  Order failed: insufficient margin for AAPL x100
   [09:30:45] executor  Connection timeout to broker
   ```

6. For `--search`, show matches with context:
   - 2 lines before and after each match
   - Highlight matching text
   - Show total match count

7. Common log patterns to recognize:
   - Order lifecycle: submitted → acknowledged → filled/rejected
   - Errors: exceptions, tracebacks, failed operations
   - Performance: slow queries, timeouts
   - Security: auth failures, rate limits