# Quick look: top error messages in one log file
grep -i "error" app.log | cut -d' ' -f5- | sort | uniq -c | sort -rn | head -5
# Great for a fast check on one file — hard to extend to joins or many dimensions

import pandas as pd

logs = pd.read_csv("app_logs.csv", parse_dates=["timestamp"])   # timestamp, service, level, message
errors = logs[logs["level"].str.upper() == "ERROR"]
by_hour = (errors.set_index("timestamp")
                 .groupby("service")
                 .resample("1h")["message"].count()
                 .rename("errors").reset_index())
print(by_hour.sort_values("errors", ascending=False).head())

import pandas as pd

# Example billing export columns: usage_date, service, cost, tag_team
bill = pd.read_csv("billing_export.csv", parse_dates=["usage_date"])
bill["tag_team"] = bill["tag_team"].fillna("UNTAGGED")

by_team = bill.groupby("tag_team")["cost"].sum().sort_values(ascending=False)
print(by_team.round(2))
print("Untagged share:", round(by_team.get("UNTAGGED", 0) / by_team.sum() * 100, 1), "%")

bill["month"] = bill["usage_date"].dt.to_period("M")
pivot = bill.pivot_table(index="service", columns="month", values="cost", aggfunc="sum", fill_value=0)
last, prev = pivot.columns[-1], pivot.columns[-2]
pivot["change"] = pivot[last] - pivot[prev]
print(pivot.sort_values("change", ascending=False).head(5).round(2))
# Column names differ by provider export — map them first

import pandas as pd

inv = pd.read_csv("inventory.csv")          # resource_id, type, owner_tag
approved = pd.read_csv("approved.csv")      # resource_id

check = inv.merge(approved, on="resource_id", how="left", indicator=True)
unapproved = check[check["_merge"] == "left_only"]
missing_owner = inv[inv["owner_tag"].isna()]
print(len(unapproved), "unapproved resources")
print(len(missing_owner), "resources missing an owner tag")
unapproved.drop(columns="_merge").to_csv("unapproved_resources.csv", index=False)

metrics = pd.read_csv("cpu_7day_avg.csv")    # resource_id, avg_cpu
idle = inv.merge(metrics, on="resource_id").query("avg_cpu < 5")
print(idle[["resource_id", "type", "owner_tag", "avg_cpu"]])
# Threshold is an example — confirm with owners before stopping anything

Which tool?
One-off look at one log file         → grep / awk / less
Quick shareable table for a manager  → spreadsheet (from a pandas export)
Monthly cost report                  → pandas script, scheduled
Compare two inventories              → pandas merge
Very large logs (many GB)            → log platform or SQL engine
Real-time alerts                     → monitoring tools, not pandas

cloud_report/
├── config.yaml        # column mappings, thresholds
├── load.py            # read exports, standardise columns
├── analyse.py         # pure functions: cost_by_team, untagged_share
├── report.py          # write CSV/Excel, summary text
├── tests/test_analyse.py
└── run.sh             # entry point for cron or CI

Weekly cloud report
1. Total spend vs last week
2. Top 5 services by cost and change
3. Untagged spend share
4. Unapproved or idle resources (count + list link)
5. Error trend by service
6. Actions requested from teams