Debug Production Traffic: Live Inspection and Request Replay

The hardest bugs are the ones tied to a specific request you never see — a malformed header from one client, a payload shape your tests never generate, an intermittent 500 under real load. The Ngris Traffic Inspector is built for exactly this: it captures requests flowing through your endpoints, lets you slice them with a precise filter, and replays the offending one against your local backend.

Capture every request

Live Tail shows inbound requests in real time with searchable payloads, from both the CLI and the dashboard. The dashboard uses a condition builder: each condition combines a dimension, an operator, and a value, and conditions stack. The dimensions are concrete:

• Request shape — host, path, method, status, protocol.
• Origin — source_ip, asn, country.
• Client — ua (user-agent), browser, os.

Operators range from exact (equals, not_equals) through substring matches on the free-text dimensions (contains, starts_with, ends_with) to set membership (in, not_in). Sensitive headers are redacted by default based on your org's policy.

Search and filter from the CLI

The same data is one command away. Search the captured payloads, filter to the status codes you care about, live-tail new requests, then stream it as JSON into your own tooling:

# Errors matching a string, live-tailed as they arrive
ngris inspect --search "payment_intent" --status 4xx,5xx --follow

# Just the failures
ngris inspect --status 4xx,5xx

# Pipe into jq
ngris inspect --json | jq '.[].path'

Full options are in the Traffic Inspector docs.

Replay against your local backend

Once you've isolated the request, re-send it to your tunnel's local backend — verbatim, or with edits to the method, headers, or body for debugging:

# Replay verbatim to the local backend
ngris replay --id <req_id>

# Override the method, a header, and the body
ngris replay --id <req_id> --method POST \
  --set-header "X-Debug: 1" \
  --body '{"test": true}'

Prefer to click? The local inspector dashboard and TUI give every request a Replay and Edit & Replay button, and replays show up back in the list badged replay. Replay bypasses the public edge and doesn't follow redirects, so you see exactly what your backend returns — perfect for regression-testing a fix. See the Replay docs.

Plan notes

The Traffic Inspector is gated by the traffic_inspector entitlement, which every current plan includes. Traffic logs are kept for your plan's retention (3 days on Developer, 15 on Team, 30 on Enterprise). If you need them around longer for postmortems, a paid plan can add the extended log retention add-on, billed per extra day. Compare options on the pricing page.

Want the inspector to do more of the work for you? Ngris AI features add per-request AI explanations and a natural-language smart-filter that compiles plain English into a real Traffic Inspector filter on top of the same captured data.