reading json logs is not natural and jq can be complicated to use
sometimes.

howto/gitlab.md

@@ -647,6 +647,29 @@ This command also shows general info about the GitLab instance:
 
 it is especially useful to find on-disk files and package versions.
 
+### Filtering through json logs
+
+The most useful log to look into when trying to identify errors or traffic
+patterns is `/var/log/gitlab-rails/production_json.log`. It shows all of the
+activity on the web interface.
+
+Since the file is formatted in JSON, to filter through this file, you need to
+use `jq` to filter lines. Here are some useful examples that you can build upon
+for your search:
+
+To find requests that got a server error (e.g. 500 http status code) response:
+
+    jq 'select(.status==500)' production_json.log
+
+To get lines only from a defined period of time:
+
+    jq --arg s '2024-07-16T07:10:00' --arg e '2024-07-16T07:19:59' 'select(.time | . >= $s and . <= $e + "z")' prodcution_json.log
+
+To identify the individual IP addresses with the highest number of requests for
+the day:
+
+    jq -rC '.remote_ip' production_json.log | sort | uniq -c | sort -n | tail -10
+
 ### GitLab pages not found
 
 If you're looking for a way to track GitLab pages error, know that the