Jaslog

A log reader for structured logs that handles non-json lines, displays beautifully colored logs and can filter based on the fields of the json.

non-json lines will be displayed but marked clearly
filters work for any fields, even fields that are not recognized
if the structure of the JSON is not recognized, all the field will be shown on the log line
there is no way to control which fields are displayed
there is no way to control the formatting

It will work especially well with certain specific JSON structures (see "Supported formats").

Install

Using cargo install

cargo install jaslog

Using pre-built binaries

Download the binary from the latest release
Put it in the folder that's part of your PATH
Make it executable (chmod +x)

Usage

Basic usage:

$ jaslog file.json.log

Or using stdin:

$ cat file.json.log | jaslog

You can filter. Syntax is:

<field>=<value>: search for exact value of field
<field>=+<value>: search for value in field (suggestions of a better syntax are welcome :-P)
<field>=^<value>: search for absence of value in field (suggestions of a better syntax are welcome :-P)

$ jaslog file.json.log -f level=info

You can also can also ask to read only the first n lines:

$ jaslog file.json.log -f level=info -n 50

Explicitly supported formats

Pull requests to support new formats are welcome of course !

Elixir logs:

{
  "app": "ecto_sql",
  "level": "info",
  "message": "create index etc...",
  "metadata": {},
  "module": "Elixir.Ecto.Migration.Runner",
  "pid": "#PID<0.280.0>",
  "timestamp": "2019-12-18T10:55:50.000393"
}

Logstash's jsonevent-layout logs:

{
  "@timestamp": "2020-01-13T12:34:01.740Z",
  "source_host": "04fc4fd30dc3",
  "file": "Dispatcher.java",
  "method": "tryAcceptLeadershipAndRunJobs",
  "level": "DEBUG",
  "line_number": "927",
  "thread_name": "flink-akka.actor.default-dispatcher-3",
  "@version": 1,
  "logger_name": "org.apache.flink.runtime.dispatcher.StandaloneDispatcher",
  "message": "Dispatcher akka.tcp://flink@04fc4fd30dc3:6123/user/dispatcher accepted leadership with fencing token 00000000000000000000000000000000. Start recovered jobs.",
  "class": "org.apache.flink.runtime.dispatcher.Dispatcher",
  "mdc": {}
  }

Log4J's JSONLayout logs:

{
  "thread": "main",
  "level": "INFO",
  "loggerName": "org.apache.flink.runtime.dispatcher.DispatcherRestEndpoint",
  "message": "Starting rest endpoint.",
  "endOfBatch": false,
  "loggerFqcn": "org.apache.logging.slf4j.Log4jLogger",
  "instant": {
    "epochSecond": 1622724607,
    "nanoOfSecond": 420000000
  },
  "threadId": 1,
  "threadPriority": 5
}

Releasing

Update version in Cargo.toml
Commit
tag with v<version>, then push
run cargo publish