Hosting Operations

Count Request IDs in Error Lines

An app log includes request IDs, and you need to see which failing request appears more than once.

Command

grep -Ei 'error|timeout|fatal|exception' fixtures/incidents/app.log | awk '{for (i=1;i<=NF;i++) if ($i ~ /^request_id=/) print $i}' | sort | uniq -c | sort -nr

What changed

Nothing changes. The command extracts request IDs from severe lines and counts repeats.

Danger

safe

When to use it

Use when multiple log lines may belong to the same failed request or job.

When not to use it

Do not use it when logs lack stable IDs; group by source, path, user, or job name instead.

Undo or recovery

No undo needed because the command is read-only.

Expected output

Counts followed by request_id values.

demo script

Disposable terminal steps

grep -Ei 'error|timeout|fatal|exception' fixtures/incidents/app.log
grep -Ei 'error|timeout|fatal|exception' fixtures/incidents/app.log | awk '{for (i=1;i<=NF;i++) if ($i ~ /^request_id=/) print $i}' | sort | uniq -c | sort -nr

Terminal transcript Demo JSON

simulated output

What it looks like

disposable vessel

::fixture-ready::
$ grep -Ei 'error|timeout|fatal|exception' fixtures/incidents/app.log
2026-06-25T14:03:08Z level=ERROR service=api request_id=req-103 msg=database_timeout timeout_ms=30000
2026-06-25T14:03:12Z level=ERROR service=api request_id=req-103 msg=retry_failed upstream=db
2026-06-25T14:05:10Z level=FATAL service=worker request_id=req-105 msg=job_runner_exit code=137
2026-06-25T14:06:33Z level=ERROR service=api request_id=req-107 msg=payment_provider_500 provider=demo-pay
::exit-code::0
$ grep -Ei 'error|timeout|fatal|exception' fixtures/incidents/app.log | awk '{for (i=1;i<=NF;i++) if ($i ~ /^request_id=/) print $i}' | sort | uniq -c | sort -nr
      2 request_id=req-103
      1 request_id=req-107
      1 request_id=req-105
::exit-code::0

YouTube Short

Group errors by request ID.

If logs have request IDs, count them in severe lines. One repeated ID can connect the chain of failure.

experiments

A/B tests to run

Metric: save_rate

A: Connect errors by request ID.

B: Count repeated failing IDs.