Log aggregation visualization pattern
Skill kjuhwa/skills-hub/skills/design/log-aggregation-visualization-pattern
Self-correcting knowledge corpus for Claude Code — 9 stable shape clusters, bias-correction pipeline baked into contribution flow. 47 papers, 45 techniques, 1.1k skills.
npx -y skills add kjuhwa/skills-hub --skill log-aggregation-visualization-patternAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Visual patterns for rendering streaming logs, heatmap density, and query-filtered timelines in log aggregation UIs
SKILL.md
1.9 KB, as published. Nobody here has run it
log-aggregation-visualization-pattern
Log aggregation visualizations share three archetypes that map directly to operator mental models. A stream river renders a continuously scrolling vertical or horizontal lane per source (host/service/pod), with each log line as a colored tick whose hue encodes severity (trace/debug/info/warn/error/fatal) and whose width encodes burst intensity. Tail-follow mode auto-scrolls but pauses on hover to prevent the "rubber band" problem where operators can never click a line. A density heatmap buckets logs into a 2D grid of time_bucket × source (or time_bucket × log_level) with cell opacity proportional to log(count+1) — plain linear scaling collapses because error spikes are 100-1000× baseline. A query console timeline overlays a histogram strip above the result table so filter changes visibly reshape the time distribution, giving operators feedback that their regex/lucene query is actually narrowing the set.
Severity color must be consistent across all three views and must survive colorblind rendering — use the convention trace=gray, debug=blue, info=green, warn=amber, error=red, fatal=magenta/purple rather than red-green-only scales. Time axis should support both wallclock and relative ("5m ago") modes, and brushing a range in the heatmap should filter both the stream river and the query results — this cross-filtering is the entire reason to co-locate the three panels. Always show a "gap indicator" (dashed cell, striped lane) when a source stops emitting, because in log aggregation the absence of logs is itself a signal (crashed agent, network partition, log rotation bug).