All flags can be combined with any subcommand or main analysis execution:
| Flag | Short | Default | Description & Usage Example |
|---|---|---|---|
--from |
- | "" |
Filter entries after a time (RFC3339 or relative: 5m, 1h, 2d). caddy-analyze --from 1h |
--to |
- | "" |
Filter entries before a time (RFC3339). caddy-analyze --to 2024-01-02T00:00:00Z |
--ip |
- | "" |
Filter by client IP or CIDR subnet. caddy-analyze --ip 192.168.1.50 or --ip 10.0.0.0/8 |
--exclude-ip |
- | "" |
Exclude IP or CIDR subnet. caddy-analyze --exclude-ip 10.0.0.0/8 |
--status |
-s |
"" |
Filter by status code(s). caddy-analyze -s 200,404 |
--method |
-m |
"" |
Filter by HTTP method. caddy-analyze -m POST |
--path |
-p |
"" |
Filter by path glob. caddy-analyze -p /api/* |
--slow |
- | "" |
Filter requests slower than duration. caddy-analyze --slow 500ms |
--2xx |
- | false |
Filter 2xx success responses. caddy-analyze --2xx |
--3xx |
- | false |
Filter 3xx redirect responses. caddy-analyze --3xx |
--4xx |
- | false |
Filter 4xx client errors. caddy-analyze --4xx |
--5xx |
- | false |
Filter 5xx server errors. caddy-analyze --5xx |
--errors-only |
-e |
false |
Filter server errors only. caddy-analyze -e |
--no-bots |
- | false |
Exclude bot/crawler traffic. caddy-analyze --no-bots |
--bots-only |
- | false |
Include only bot traffic. caddy-analyze --bots-only |
--grep |
-g |
"" |
Search across URI, User-Agent, IP, Host. caddy-analyze -g "/api" |
When entry-level filters (--ip, -s, -m, -p, --5xx, --no-bots, -g, etc.) are active, caddy-analyze automatically switches to a color-coded log listing instead of the aggregate report. Active filters are shown in the output header for all formats.
caddy-analyze --ip 10.0.0.0/8 access.log 15 entries matched 14:29:01 204 OK OPTIONS /heartbeat (0 B, 1.05ms) - 104.28.161.103 14:29:01 200 OK POST /heartbeat (0 B, 4.04ms) - 104.28.161.103
Use -f json, -f csv, -f html, or -o <file> to force the aggregate report. Time-based filters (--from, --to) alone still show the report.
| Flag | Short | Default | Description & Usage Example |
|---|---|---|---|
--detect |
-d |
false |
Enable security threat detection (SQLi, XSS, Path Traversal, Log4j, RCE, Probes, Scanners). Shows per-IP suspicious request details. caddy-analyze --detect |
--format |
-f |
table |
Set output report format: table, json, csv, html. caddy-analyze -f html -o report.html |
--output |
-o |
"" |
Write report output to specified file path instead of stdout. caddy-analyze -o analysis.txt |
--watch |
-w |
false |
Launch 6-tab interactive full-screen terminal TUI dashboard (Bubbletea). caddy-analyze --watch |
--top |
-t |
10 |
Set maximum number of top entries displayed in tables. caddy-analyze -t 25 |
--interval |
-i |
"" |
Periodically re-run analysis every N duration (e.g. 10s, 1m). caddy-analyze -i 10s |
--follow |
-F |
false |
Stream and process incoming log lines in real-time follow mode (like tail -f). caddy-analyze -F |
caddy-analyze [source] [flags]Runs batch analysis over the log source. When entry-level filters are active, shows a color-coded log listing instead of the aggregate report. Supports all flags.
caddy-analyze caddy-analyze --detect caddy-analyze --ip 10.0.0.0/8 caddy-analyze --5xx --no-bots caddy-analyze -f html -o report.html
tail [source] [flags]Streams and colorizes access log entries in real time. Supports all root-level filters (--ip, --5xx, --no-bots, etc.).
caddy-analyze tail docker://my-caddy caddy-analyze tail --ip 192.168.1.100 --no-bots
top [dimension] [source] [flags]Inspects top metrics by dimension (path, ip, ua, status, method, host, bandwidth). Supports -b, --by <dim> flag and filters like --5xx, --slow, --no-bots.
diff <log1> <log2>Compares two log files side-by-side to detect RPS shifts, 5xx error spikes, latency regressions, and new failing URIs between deployments.
config [show|set|reset]Manages persistent default log source settings in local (./caddy-analyzer.json) or global (~/.config/caddy-analyzer/config.json) JSON config files.
guard [source] & block / unbanMonitors streaming logs and automatically adds offending IP addresses to Linux iptables DROP rules when attack thresholds are exceeded (--limit 50 --window 1m).