loggrep 0.2.0

A smarter log parser with color-coded severity, time filtering, regex matching, and stats
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160

<p align="center">
  <img src="assets/logo.svg" alt="loggrep" width="400" />
</p>

<p align="center">
  <img src="https://img.shields.io/badge/Rust-000000?style=flat-square&logo=rust&logoColor=white" alt="Rust" />
  <img src="https://img.shields.io/badge/License-MIT-blue?style=flat-square" alt="MIT License" />
</p>

---

![loggrep demo](assets/demo-hero.png)

## What is this

A log parser for the terminal that does what you actually want. Color-codes severity levels, filters by time range, regex searches, gives you stats, handles JSON logs, and follows files in real-time.

## Install

**From source** (requires [Rust](https://rustup.rs/)):

```bash
git clone https://github.com/dyascj/loggrep-cli.git
cd loggrep-cli
cargo install --path .
```

**Prebuilt binaries** — grab the latest from [Releases](https://github.com/dyascj/loggrep-cli/releases).

## Usage

```bash
# just color-code a log file
loggrep app.log

# filter by severity
loggrep app.log -l error
loggrep app.log -l error,warn
loggrep app.log -l warn+             # warn and above

# regex search
loggrep app.log -p "timeout|OOM"

# time range
loggrep app.log --from "11:00" --to "12:00"

# combine filters
loggrep app.log -l error -p "stripe" --from "07:00" --to "15:00"

# stats summary
loggrep app.log --stats              # lines + stats
loggrep app.log -S                   # stats only

# follow mode (like tail -f with filtering)
loggrep app.log -f
loggrep app.log -f -l error

# pipe from stdin
kubectl logs my-pod | loggrep -p "timeout"
journalctl -f | loggrep -l warn+

# context lines (like grep -C/-B/-A)
loggrep app.log -p "error" -C 3      # 3 lines before & after
loggrep app.log -p "OOM" -B 5        # 5 lines before each match
loggrep app.log -p "crash" -A 2      # 2 lines after each match

# compressed logs
loggrep app.log.gz -l error          # reads gzip files directly

# multiple files
loggrep *.log -l error               # prefixes each match with filename

# other stuff
loggrep app.log -c                   # count matches
loggrep app.log -l error --json      # output as JSON
loggrep app.log -v -p "healthcheck"  # invert match
loggrep app.log -n                   # line numbers
```

## Features

### Severity detection

Picks up log levels from `[ERROR]`, `level: error`, `{"level": "error"}`, and color-codes them automatically.

![Severity filtering](assets/feature-severity.png)

### Time ranges & regex

Handles bracketed datetimes, ISO 8601, syslog format, and JSON timestamp fields. The `--from` / `--to` flags are flexible. Combine with `-p` for regex pattern matching with highlighted results.

```
"2026-02-24 11:00:00"   full datetime
"2026-02-24"            date (starts at midnight)
"11:00"                 time (assumes today)
```

![Regex and time range filtering](assets/feature-regex.png)

### Stats

Line counts, time span, severity breakdown, and top recurring errors.

![Stats summary](assets/feature-stats.png)

### Pipes into anything

Works with stdin so you can pipe from `kubectl`, `journalctl`, `docker logs`, or anything else.

![Pipe support](assets/feature-pipes.png)

### Follow mode

Like `tail -f` but with all filtering and coloring applied. Uses filesystem events (kqueue/inotify) so it's not polling.

### Context lines

Show surrounding lines around matches, just like `grep -C`:

```bash
loggrep app.log -p "panic" -C 5      # 5 lines before and after
loggrep app.log -p "OOM" -B 10       # 10 lines before each match
loggrep app.log -p "timeout" -A 3    # 3 lines after each match
```

### Compressed logs

Reads `.gz` files directly — no need to decompress first:

```bash
loggrep /var/log/syslog.1.gz -l error
loggrep app.log.gz app.log -p "crash"   # mix compressed and plain
```

### JSON logs

Parses structured JSON logs (one object per line), extracts message/level/timestamp fields, and displays the rest as `key=value` pairs.

### Config file

Create `.loggrep.toml` in your project or `~/.config/loggrep/config.toml` for defaults:

```toml
line_numbers = true
level = "warn+"
```

### Shell completions

Generate completions for your shell:

```bash
loggrep --completions bash > ~/.local/share/bash-completion/completions/loggrep
loggrep --completions zsh > ~/.zfunc/_loggrep
loggrep --completions fish > ~/.config/fish/completions/loggrep.fish
```

## License

MIT