Log File Parser and Analyzer CLI

Project roadmap

1. 01

   Parse a log line

   ~1.5h

   Create a project with regex, chrono and clap. Write a regex for the combined log format (compiled once, for example with std::sync::LazyLock) that captures the IP, time, method, path, status, size, referrer and user agent, and also accepts the common format without the last two. Write a parse_line function returning Option<LogEntry>. Done when: unit tests parse sample lines in both formats and reject broken lines.

2. 02

   Model the entries

   ~1.5h

   Define a LogEntry struct and parse the time (such as 10/Oct/2026:13:55:36 +0000) into a chrono DateTime with its time zone, the status into a number and the size (- means 0). Read the file line by line with a BufReader, count broken lines, and print a warning with the first few. Support reading from standard input. Done when: a sample log is parsed, and broken lines are counted.

3. 03

   Aggregate statistics

   ~1.5h

   Compute with HashMaps: requests and bytes per IP, counts per status code and per status class (2xx, 3xx, 4xx, 5xx), and requests per path (without query strings). Sort to get the top N of each (a --top option, default 10). Done when: the statistics for a small log match counts made by hand.

4. 04

   Show requests per hour

   ~1h

   Group requests by hour using the parsed times (in UTC, or local time with --local), and print a text histogram with one row per hour and a bar made of █ characters scaled to the busiest hour, with the count at the end. Done when: the histogram shows the traffic pattern of a sample log.

5. 05

   Add filters and output options

   ~1.5h

   Add clap options: --from and --to dates, --status (a code such as 404 or a class such as 5xx) and --path-prefix, applied before aggregating. Add --json to print all statistics as JSON (with serde). Validate the options and show clear errors. Done when: filters change the report correctly, and --json produces valid JSON.

6. 06

   Test and measure

   ~1.5h

   Write unit tests for parsing, filters and aggregation, and an integration test running the binary on a fixture log (for example with the assert_cmd crate). Generate a large log file and measure how long the tool takes, noting it in README.md. Run cargo clippy. Done when: cargo test passes, clippy is clean, and README.md shows the timing.

Resources

• Docsregex crate documentation
• Docschrono crate documentation
• Docsclap derive tutorial
• DocsApache log files (combined log format)
• DocsCommand Line Applications in Rust (book)