Subcommands & Flags Specification

Complete technical reference for all CLI subcommands, flags, and options

1. Comprehensive CLI Flags Reference

All flags can be combined with any subcommand or main analysis execution:

Time Range & Request Filters

Flag Short Default Description & Usage Example
--from - "" Filter entries after a time (RFC3339 or relative: 5m, 1h, 2d). caddy-analyze --from 1h
--to - "" Filter entries before a time (RFC3339). caddy-analyze --to 2024-01-02T00:00:00Z
--ip - "" Filter by client IP or CIDR subnet. caddy-analyze --ip 192.168.1.50 or --ip 10.0.0.0/8
--exclude-ip - "" Exclude IP or CIDR subnet. caddy-analyze --exclude-ip 10.0.0.0/8
--status -s "" Filter by status code(s). caddy-analyze -s 200,404
--method -m "" Filter by HTTP method. caddy-analyze -m POST
--path -p "" Filter by path glob. caddy-analyze -p /api/*
--slow - "" Filter requests slower than duration. caddy-analyze --slow 500ms
--2xx - false Filter 2xx success responses. caddy-analyze --2xx
--3xx - false Filter 3xx redirect responses. caddy-analyze --3xx
--4xx - false Filter 4xx client errors. caddy-analyze --4xx
--5xx - false Filter 5xx server errors. caddy-analyze --5xx
--errors-only -e false Filter server errors only. caddy-analyze -e
--no-bots - false Exclude bot/crawler traffic. caddy-analyze --no-bots
--bots-only - false Include only bot traffic. caddy-analyze --bots-only
--grep -g "" Search across URI, User-Agent, IP, Host. caddy-analyze -g "/api"

Filter Behavior: Listing vs Report

When entry-level filters (--ip, -s, -m, -p, --5xx, --no-bots, -g, etc.) are active, caddy-analyze automatically switches to a color-coded log listing instead of the aggregate report. Active filters are shown in the output header for all formats.

caddy-analyze --ip 10.0.0.0/8 access.log
15 entries matched

14:29:01  204 OK  OPTIONS /heartbeat  (0 B, 1.05ms) - 104.28.161.103
14:29:01  200 OK  POST /heartbeat     (0 B, 4.04ms) - 104.28.161.103

Use -f json, -f csv, -f html, or -o <file> to force the aggregate report. Time-based filters (--from, --to) alone still show the report.

Display & Output Configuration Flags

Flag Short Default Description & Usage Example
--detect -d false Enable security threat detection (SQLi, XSS, Path Traversal, Log4j, RCE, Probes, Scanners). Shows per-IP suspicious request details. caddy-analyze --detect
--format -f table Set output report format: table, json, csv, html. caddy-analyze -f html -o report.html
--output -o "" Write report output to specified file path instead of stdout. caddy-analyze -o analysis.txt
--watch -w false Launch 6-tab interactive full-screen terminal TUI dashboard (Bubbletea). caddy-analyze --watch
--top -t 10 Set maximum number of top entries displayed in tables. caddy-analyze -t 25
--interval -i "" Periodically re-run analysis every N duration (e.g. 10s, 1m). caddy-analyze -i 10s
--follow -F false Stream and process incoming log lines in real-time follow mode (like tail -f). caddy-analyze -F

2. Subcommands Specification

caddy-analyze [source] [flags]

Runs batch analysis over the log source. When entry-level filters are active, shows a color-coded log listing instead of the aggregate report. Supports all flags.

caddy-analyze
caddy-analyze --detect
caddy-analyze --ip 10.0.0.0/8
caddy-analyze --5xx --no-bots
caddy-analyze -f html -o report.html

tail [source] [flags]

Streams and colorizes access log entries in real time. Supports all root-level filters (--ip, --5xx, --no-bots, etc.).

caddy-analyze tail docker://my-caddy
caddy-analyze tail --ip 192.168.1.100 --no-bots

top [dimension] [source] [flags]

Inspects top metrics by dimension (path, ip, ua, status, method, host, bandwidth). Supports -b, --by <dim> flag and filters like --5xx, --slow, --no-bots.

diff <log1> <log2>

Compares two log files side-by-side to detect RPS shifts, 5xx error spikes, latency regressions, and new failing URIs between deployments.

config [show|set|reset]

Manages persistent default log source settings in local (./caddy-analyzer.json) or global (~/.config/caddy-analyzer/config.json) JSON config files.

guard [source] & block / unban

Monitors streaming logs and automatically adds offending IP addresses to Linux iptables DROP rules when attack thresholds are exceeded (--limit 50 --window 1m).