Skip to content
Search

NerdLog

lastmod 2025-04-23created 2025-04-231 edits

Nerdlog: fast, remote-first, multi-host TUI log viewer with timeline histogram and no central server

A fast multi-host TUI log viewer with a timeline histogram

About

  • A fast, resource-efficient TUI multi-host log viewer that can collect and analyze remote logs over SSH connections alone, without a central server
  • Timeline histogram visualization and time filtering make it easy to follow the flow of logs
  • Uses basic combinations of awk, tail, and head for fast processing and easy setup
  • Log queries are processed remotely without local downloads, minimizing network usage and optimized for handling large logs
  • Simple by default, but extensible through various config files, SSH config, and UI controls

Introduction to Nerdlog

  • Nerdlog is a text-based UI log viewer that works without a central server
  • Can analyze logs like Graylog/Kibana, but is a lightweight alternative tool with no installation or maintenance burden
    • The initial motivation for development came from frustration with slow and inefficient Splunk
  • Optimized for filtering and visualizing logs from multiple remote servers simultaneously
  • Designed mainly to handle system logs (/var/log/messages, /var/log/syslog), but also supports other formats
  • Can quickly process large logs of 1GB or more
  • The core goal is to maximize the speed and efficiency of multi-node log lookups

Design characteristics

  • Works without a central server, creating an ssh connection to each node and keeping it idle
  • Does not download entire logs; transfers only up to 250 log messages and histogram data per query
  • Merges all responses to provide a unified view
  • Uses Gzip compression during transfer to reduce network costs

Project status and history

  • Created in 2022 during a personal hackathon as a replacement for slow Splunk, and released as open source in 2025
  • Implemented quickly, so it has spaghetti code and lacks test coverage
  • Tested in real use only on Linux
  • At the proof-of-concept stage, but fast and stable enough for real use

Usage summary

  • Launching the app brings up a query input box
  • A logstream means a series of consecutive log files on a server accessible via ssh
  • You can specify the ssh port, log file paths, etc., or use ssh config and a separate config file
  • The Select field expression specifies the fields to display in the UI, SQL-style

See also

Favorite site

author Zer0 sitemap