heisentest → guides

How to correlate two log files by timestamp

The gateway log shows 502s from 02:14:07. The app log shows… something, somewhere around then. Every real incident investigation ends up here: two (or five) files, one question — what happened first?

The manual way

sort -m app.sorted.log gateway.sorted.log > merged.log

sort -m merges pre-sorted files — but only if both files start each line with the same timestamp format, which an nginx file ([26/Jul/2026:02:14:04 +0000]) and a JSON app log ("time":"2026-07-26T02:14:04.612Z") never do. You end up writing a one-off normalization script at 2 a.m. In the terminal, lnav is the mature answer — it normalizes formats and merges files properly.

The zero-install way

Drop both files on heisentest. Each file's format is detected on its own (JSON lines, access log, syslog, plain framework logs), timestamps are normalized onto one clock, and the merged view interleaves them — each file marked with its own color thread. The timeline shows both files' events stacked, so "app OOM at 02:14:04, first gateway 502 at 02:14:07" stops being an inference and becomes a thing you can see.

Filter still works across the merge — "ERROR only, both files".
Click any gateway error, read the app's lines just above it.
Local only: both files stay in your browser tab.

See it in 10 seconds: the sample incident on heisentest.com is a two-file merge — load it and look at the 02:14 spike.

Honest limits

If two machines' clocks disagreed, the merge inherits the skew — no tool can conjure the true order from wrong clocks. Lines with no parseable timestamp keep their file position rather than joining the merge.