Why Every DevOps Engineer Should Learn pandas in 2026

import re
import pandas as pd

LINES = [
    '10.0.0.1 - - [05/Mar/2026:14:01:02 +0530] "GET /api/orders HTTP/1.1" 200 512 0.120',
    '10.0.0.2 - - [05/Mar/2026:14:01:05 +0530] "GET /api/orders HTTP/1.1" 500 98 1.900',
    '10.0.0.1 - - [05/Mar/2026:14:02:10 +0530] "POST /api/login HTTP/1.1" 200 210 0.300',
    '10.0.0.3 - - [05/Mar/2026:15:10:00 +0530] "GET /api/orders HTTP/1.1" 502 98 2.400',
]
PATTERN = re.compile(r'(\S+) - - \[(.+?)\] "(\S+) (\S+) \S+" (\d{3}) (\d+) ([\d.]+)')
rows = [m.groups() for line in LINES if (m := PATTERN.match(line))]
df = pd.DataFrame(rows, columns=["ip", "time", "method", "path", "status", "bytes", "seconds"])
df["time"] = pd.to_datetime(df["time"], format="%d/%b/%Y:%H:%M:%S %z")
df[["status", "bytes"]] = df[["status", "bytes"]].astype(int)
df["seconds"] = df["seconds"].astype(float)
df["is_error"] = df["status"] >= 500
print(df.groupby("path")["is_error"].mean().mul(100).round(1).rename("error_%"))

import pandas as pd

# Assume df from the previous tab; here a small stand-in
df = pd.DataFrame({
    "time": pd.to_datetime(["2026-03-05 14:01", "2026-03-05 14:20", "2026-03-05 15:10", "2026-03-05 15:40"]),
    "is_error": [False, True, True, True],
})
hourly = df.set_index("time").resample("h")["is_error"].agg(["count", "sum"])
hourly["error_%"] = (hourly["sum"] / hourly["count"] * 100).round(1)
print(hourly)

import pandas as pd

runs = pd.DataFrame({
    "run_id": [1, 1, 1, 2, 2, 2, 3, 3, 3],
    "stage": ["install", "test", "build"] * 3,
    "seconds": [60, 420, 90, 65, 610, 95, 58, 400, 88],
    "result": ["ok", "ok", "ok", "ok", "failed", "skipped", "ok", "ok", "ok"],
})
summary = runs.groupby("stage").agg(
    median_s=("seconds", "median"),
    p95_s=("seconds", lambda s: s.quantile(0.95)),
    failure_rate=("result", lambda r: (r == "failed").mean()),
).sort_values("median_s", ascending=False)
print(summary)

#!/usr/bin/env bash
# Export recent workflow runs to JSON with the GitHub CLI
set -euo pipefail
gh run list --limit 100 \
  --json databaseId,workflowName,conclusion,createdAt,updatedAt \
  > runs.json
python - <<'PY'
import pandas as pd
df = pd.read_json("runs.json")
df["minutes"] = (pd.to_datetime(df["updatedAt"]) - pd.to_datetime(df["createdAt"])).dt.total_seconds() / 60
print(df.groupby("workflowName")["minutes"].describe().round(1))
print(df["conclusion"].value_counts())
PY

import pandas as pd

# Small stand-in for a billing export (made-up values)
cost = pd.DataFrame({
    "date": pd.to_datetime(["2026-01-10", "2026-01-20", "2026-02-10", "2026-02-20", "2026-02-25"]),
    "service": ["Compute", "Storage", "Compute", "Storage", "Database"],
    "team": ["web", "data", "web", None, "data"],
    "cost": [120.0, 40.0, 180.0, 42.0, 75.0],
})
cost["month"] = cost["date"].dt.to_period("M").astype(str)
print(cost.pivot_table(index="service", columns="month", values="cost", aggfunc="sum", fill_value=0))
print("untagged cost:", cost.loc[cost["team"].isna(), "cost"].sum())

import pandas as pd

incidents = pd.DataFrame({
    "opened": pd.to_datetime(["2026-01-03 10:00", "2026-01-18 22:10", "2026-02-07 09:30", "2026-02-21 14:00"]),
    "resolved": pd.to_datetime(["2026-01-03 12:30", "2026-01-19 01:10", "2026-02-07 10:15", "2026-02-21 14:40"]),
    "cause": ["bad deploy", "disk full", "bad deploy", "config change"],
})
incidents["restore_min"] = (incidents["resolved"] - incidents["opened"]).dt.total_seconds() / 60
incidents["month"] = incidents["opened"].dt.to_period("M")
print(incidents.groupby("month")["restore_min"].median())
print(incidents["cause"].value_counts())

# pip install pandas tabulate
import pandas as pd

def section(title: str, df: pd.DataFrame) -> str:
    return f"## {title}\n\n{df.to_markdown()}\n"

pipelines = pd.DataFrame({"stage": ["test", "build"], "median_s": [420, 90]}).set_index("stage")
costs = pd.DataFrame({"service": ["Compute", "Database"], "change_%": [50.0, 12.5]}).set_index("service")
incidents = pd.DataFrame({"metric": ["count", "median restore min"], "value": [2, 42]}).set_index("metric")

report = "# Weekly ops report\n\n" + section("Pipelines", pipelines) + section("Costs", costs) + section("Incidents", incidents)
open("weekly_ops_report.md", "w").write(report)
print(report)

# Weekly ops report (template)

1. Pipelines: median and p95 duration per stage; failure rate
2. Errors: top endpoints by 5xx rate; any spikes
3. Costs: change by service vs last week; untagged cost
4. Incidents: count, median time to restore, causes
5. Actions: one improvement for next week, with owner

Week 1  pandas basics: DataFrames, read_csv, read_json
Week 2  Parse logs with regex into DataFrames
Week 3  groupby, resample, quantiles for pipeline data
Week 4  Cost export and incident analysis
Week 5  Automate the weekly report; schedule it