Show HN: LogsQL – opinionated query language for logs

- Simplicity. It is easy to write typical queries over logs in it. For example, a single word `error` is a valid LogsQL query, which returns all the logs with the `error` word. Another example is `_time:5m error`, which returns all the logs with the 'error' word over the last 5 minutes.

- Composable building blocks similar to Unix pipes, which allow powerful filtering, transforming and calculating stats over the selected logs. For example, `_time:5m error | stats count() as rows` returns the number of logs with the `error` word over the last 5 minutes.

- Readability. Typical LogsQL queries must be easy to read and understand even for persons unfamiliar with it.

Take a look at LogsQL docs [1] and try using VictoriaLogs [2] in production. If you like Unix way and KISS design principle, then you'll enjoy LogsQL :)

[1] https://docs.victoriametrics.com/victorialogs/logsql/

[2] https://docs.victoriametrics.com/victorialogs/

Show HN: LogsQL – opinionated query language for logs
docs.victoriametrics.com

You wrote that you don't like Loki's LogQL, but it looks quite similar (Victoria's LogQL first):

  log.level:error _stream:{app!~"buggy_app|foobar"}
  {app!~"buggy_app|foobar"} | "log.level:error"

Maybe I missed something fundamental though, interested to hear more about the differences, since I only read the couple links you shared!

I am happy that in my day to day work I can dump my mostly Linux logs to rsyslog, and eventually forward them to S3 glacier for a few years.

So I am guessing the question I am asking is that what in the world are you doing with these observability or SIEM platforms and is anyone actually deriving some REAL value from using them?

I wish. But 'regulatory compliance'. And 'we might need them' - just not sure for what - but we'll try another data analyst next quarter. Thankfully because of the GDPR (and maybe other reasons) there is a healthy pressure to also cleanse us from the logs we've collected.

That said, I agree, based on my trials (and mostly errors), Splunk seems one of the better ones. Not considering the cost anyway. My trouble is that I am not a data analyst, but I get asked more than I would like about these things.