Flik / Practical guides

Nginx / error frequency

Count Nginx errors per hour

Filter failed Nginx requests, count occurrences by hour and distinguish HTTP statuses from error-log severity.

Updated October 27, 2026 · Flik 0.1.0 · synthetic examples · macOS and Linux

A list of failed requests tells you what happened. A time histogram helps you see whether the same failure happened once, arrived in a burst or continued for hours. Flik applies its time report to the active filters, so the chart answers the question you just narrowed down.

Use a known access-log example

Download the five-request synthetic access log.

flik access.log

The sample contains three HTTP 200 responses, one 502 and one 503. All requests occur between 10:00 and 10:04 UTC on January 15, 2026. These are deliberately small, checkable inputs rather than a performance benchmark.

Filter server errors

1. Press 3 to add an include rule.
2. Enter status:5xx and confirm.
3. Press H to count matching events by hour.

The expected hourly bucket is 2026-01-15 10:00 UTC: 2 matching requests. A 502 response and a 503 response each contribute one occurrence. The three successful requests do not contribute to this filtered histogram.

Change the time interval

Open the investigation prompt with Ctrl+K and enter:

histogram minute

The two error buckets are 10:02 and 10:03 UTC, with one request each. The same prompt accepts histogram hour and histogram day. Time reports are UTC snapshots; close and rerun the report to refresh it after the file changes.

Inspect an error log differently

An Nginx error log contains severity and diagnostic messages, not an HTTP response for every line. Download the error-log sample, open it with Flik and press S. When HTTP statuses are absent, the dashboard uses detected severity levels instead of an empty 2xx/3xx breakdown.

Check the scope before comparing

The S dashboard samples up to 5,000 lines. Frequency reports scan the full indexed source in the background, use recognized timestamps and exclude context-only lines from occurrence counts. Missing timestamps are reported separately. Custom log layouts may require raw-text inspection; do not treat an unrecognized status or timestamp as proof of no errors.

For a live issue, compare equal time windows and keep the same filter. A higher count can reflect more traffic rather than a higher failure rate; use a request denominator when you need a rate.