Every sprint we export a JSON dump from Kibana, scroll through hundreds of log entries, and tell ourselves we will turn them into test cases later. Later never comes. The logs contain real API calls. Real endpoints, real payloads, real status codes from production. It is the closest thing to a specification of how the system actually behaves. And almost none of it ever becomes an automated test, because converting it manually takes longer than the sprint. I got tired of later. I wrote secure-log2test , a CLI that reads a Kibana JSON export and generates a ready-to-run pytest file. One command. Working tests. There is one constraint that shaped the whole design: no data leaves your machine. No LLM API calls. No cloud. Everything runs locally. Why the privacy constraint matters The obvious alternative to building a tool is asking an LLM to write the tests from your logs. It would probably work.…