An error line tells you that something failed. The useful clue may be three lines earlier: a retry, a connection message, or a request that never reached the next stage.
This walkthrough uses Flik to keep surrounding events visible while narrowing a log file. It works locally on macOS and Linux. The sample is synthetic, so you can reproduce the interaction without a running service.
1. Open a small example
Download Flik from the project page and create this small synthetic sample:
cat > flik-demo.log <<'LOG'
2026-01-15T09:00:00Z INFO service=demo-api request_id=req-demo-9 request accepted
2026-01-15T09:01:00Z WARN service=demo-api request_id=req-demo-9 connection pool exhausted
2026-01-15T09:02:00Z ERROR service=demo-api request_id=req-demo-9 request timeout
2026-01-15T09:03:00Z INFO service=demo-api request_id=req-demo-9 retry scheduled
2026-01-15T10:00:00Z INFO service=demo-api request_id=req-demo-10 request accepted
2026-01-15T10:01:00Z WARN service=demo-api request_id=req-demo-10 connection pool exhausted
2026-01-15T10:02:00Z ERROR service=demo-api request_id=req-demo-10 request timeout
2026-01-15T10:03:00Z INFO service=demo-api request_id=req-demo-10 retry scheduled
LOG
flik flik-demo.log
Files open at the end with live following enabled. Press g if you want to start at the beginning.
2. Search for the error, including its neighbours
In the main view, press / to open search. Enter the following smart-find expression, then press Enter:
//3,2:error
This retains three original lines before each match and two after it. Context lines are shown alongside the match, in the original order. Overlapping context windows are merged instead of duplicating the same lines.
Read those neighbouring events before adding another condition. Context can change the question from “which line failed?” to “what happened immediately before this request failed?”
3. Narrow one condition at a time
Press x to undo the latest filter. Press 3 to add an include filter, or 8 for an exclude filter. For example, include timeout, then exclude cache. Each rule is a separate step in the stack.
If the result becomes too narrow, x removes only the most recent rule. Ctrl+F opens the filter stack so you can inspect what is active. That matters when an empty view means “my filters excluded it”, rather than “the event never happened”.
4. Recover a wider window
Select a result and press Ctrl+G to inspect its original context. Use n and p inside that view to move between matches; Escape returns to the file. The command palette also accepts context 20 when you want 20 original lines before and after a selected event.
For a live stream, the starting point can be:
docker logs -f demo-api | flik -
The service name in that example needs to match your own container. Begin with the downloadable file if you do not have one running.
What this does—and what it cannot establish
The useful result is an inspectable sequence of events. Adjacent lines alone do not prove a cause: requests can interleave, clocks can differ, and output can be buffered. Check request identifiers and timestamps before drawing a conclusion.
Flik covers interactive filtering, context and following; keep jq for arbitrary JSON transformations and scripted pipelines. The goal is to make a manual investigation easier to inspect and revise.
Watch the short demonstration, then repeat the search on the sample:
Top comments (0)