Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

github.com

Post reply on HN
Print view View original

31–40 of 58 posts

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#31

Post by dimonomid »

johnisgood wrote: post #28

This looks good. Any way to use date/time in RFC 3339 format without changing the source code? Does this work with runit (Void Linux)?

Re: the date/time format, I was thinking about implementing support for an option like timefmt, so you'd be able to do :set timefmt=2006-01-02T15:04:05Z07:00 , but postponed for now.

That's not hard to implement, however to make it persistent requires implementing some config / scriptability, which is a whole other thing and requires more thought.

Re: runit, I never tested it, but after looking around briefly, it sounds like there is no unified log file, and not even unified log format? I mean it's possible to make it work, treating every log file as a separate logstream, but I've no idea what these logs look like and whether supporting the formats would be easy.

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#33

Post by johnisgood »

dimonomid wrote: post #31
johnisgood wrote: post #28

This looks good. Any way to use date/time in RFC 3339 format without changing the source code? Does this work with runit (Void Linux)?

Re: the date/time format, I was thinking about implementing support for an option like timefmt, so you'd be able to do :set timefmt=2006-01-02T15:04:05Z07:00 , but postponed for now. That's not hard to implement, however to make it persistent requires implementing some config / scriptability, which is a whole other thing and requires more thought. Re: runit, I never tested it, but after looking around briefly, it sou…

Void Linux uses svlogtail for viewing logs.

It is a simple script: https://github.com/void-linux/socklog-void/blob/master/svlog...

I think everything is in /var/log/socklog/everything/current, so this could be considered united.

Before you add the timefmt, it may be better to add a configuration file if one does not already exist, but it seems like it does? You already have ~/.config/nerdlog/logstreams.yaml, so might as well have config.yaml?

For more about logging on Void: https://docs.voidlinux.org/config/services/logging.html

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#34

Post by ryanhecht »

dimonomid wrote: post #21
ryanhecht wrote: post #19

I definitely intend on playing around with this later! I see that [gzipped log archives aren't supported]( https://dmitryfrank.com/projects/nerdlog/article#depends_on_... ), minimizing the use case for me personally. You've at least thought enough about that to bring it up as a limitation you think people will call attention to -- any plans to eventually support it?

Thanks for the feedback! Yeah it would be great, and I do want to support it, especially if the demand is popular. In fact, even if you ungzip them manually, as of today nerdlog doesn't support more than 2 files in a logstream, which needs to be fixed first. Specifically about supporting gzipped logs though, the UX I'm thinking about is like this: if the requested time range goes beyond the earliest available ungzipp…

Definitely makes sense!

> In fact, even if you ungzip them manually, as of today nerdlog doesn't support more than 2 files in a logstream

Ah, interesting! I read the limitation as "we don't support zipped files," not "we only support two files!"

Best of luck, this is neat!

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#35

Post by mcint »

dimonomid wrote: post #25
lenova wrote: post #22

Earlier quoted context omitted.

I think it will impact first-time users giving nerdlog a quick test/trial run, and cause them to bounce to another tool when it doesn't show them logs from journald out of the box. Users can be finicky and impatient with new tools ;-) Example: I'm running an Arch-based Linux desktop. Installing ryslog took several minutes to build and install. If I wasn't highly motivated to try out nerdlog, I would have canceled the…

I first responded before your edit about ssh and localhost, so: yeah, as briefly mentioned in the article, as of today there's no shortcut even for localhost. I was debating whether I should implement this feature before open sourcing it, but I had to draw the line somewhere (I have TONS of ideas what could be implemented), and since reading local logs isn't the primary focus of nerdlog, I decided to skip it for now.…

Yeah, I'm bouncing for now on the localhost requirement. Or, on a related issue of not parsing my .ssh/config, a Match directive, and not wanting it to parse it yet. I grep'ed for an env var to override, but only USER and SSH_AUTH_SOCK are pulled in.

I did go get install ...nerdlog/cmd/nerdlog-tui@latest just fine.

Thanks for hacking in the open, and releasing early.

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#36

Post by dimonomid »

johnisgood wrote: post #33
dimonomid wrote: post #31

Earlier quoted context omitted.

Re: the date/time format, I was thinking about implementing support for an option like timefmt, so you'd be able to do :set timefmt=2006-01-02T15:04:05Z07:00 , but postponed for now. That's not hard to implement, however to make it persistent requires implementing some config / scriptability, which is a whole other thing and requires more thought. Re: runit, I never tested it, but after looking around briefly, it sou…

Void Linux uses svlogtail for viewing logs. It is a simple script: https://github.com/void-linux/socklog-void/blob/master/svlog... I think everything is in /var/log/socklog/everything/current , so this could be considered united. Before you add the timefmt, it may be better to add a configuration file if one does not already exist, but it seems like it does? You already have ~/.config/nerdlog/logstreams.yaml , so mig…

That's good news that we have /var/log/socklog/everything/current, but I'm also trying to figure the format. Is it like this? (sourced from chatgpt)

2025-04-21 12:34:56 myhostname myservice: Something happened

If so, then yeah it's totally doable to make this format supported.

Re: config.yaml, yeah I thought of that, but in the long term I rather wanted it to be nerdlogrc.lua, so a Lua script which nerdlog executes on startup. Similar to vim (or rather, more like neovim in this case since it's Lua). Certainly having config.yaml is easier to implement, but in the longer term it may make things more confusing if we also introduce the Lua scripting.

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#37

Post by dimonomid »

mcint wrote: post #35
dimonomid wrote: post #25

Earlier quoted context omitted.

I first responded before your edit about ssh and localhost, so: yeah, as briefly mentioned in the article, as of today there's no shortcut even for localhost. I was debating whether I should implement this feature before open sourcing it, but I had to draw the line somewhere (I have TONS of ideas what could be implemented), and since reading local logs isn't the primary focus of nerdlog, I decided to skip it for now.…

Yeah, I'm bouncing for now on the localhost requirement. Or, on a related issue of not parsing my .ssh/config, a Match directive, and not wanting it to parse it yet. I grep'ed for an env var to override, but only USER and SSH_AUTH_SOCK are pulled in. I did go get install ...nerdlog/cmd/nerdlog-tui@latest just fine. Thanks for hacking in the open, and releasing early.

Sorry to hear you're having issues. I'll try to reproduce and fix the issue with the Match.

Not sure if that "Thanks" for releasing early is sarcastic, but regardless, I appreciate the feedback.

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#38

Post by johnisgood »

dimonomid wrote: post #36
johnisgood wrote: post #33

Earlier quoted context omitted.

Void Linux uses svlogtail for viewing logs. It is a simple script: https://github.com/void-linux/socklog-void/blob/master/svlog... I think everything is in /var/log/socklog/everything/current , so this could be considered united. Before you add the timefmt, it may be better to add a configuration file if one does not already exist, but it seems like it does? You already have ~/.config/nerdlog/logstreams.yaml , so mig…

That's good news that we have /var/log/socklog/everything/current, but I'm also trying to figure the format. Is it like this? (sourced from chatgpt) 2025-04-21 12:34:56 myhostname myservice: Something happened If so, then yeah it's totally doable to make this format supported. Re: config.yaml, yeah I thought of that, but in the long term I rather wanted it to be nerdlogrc.lua, so a Lua script which nerdlog executes o…

Sadly no. The format is (with examples):

  2025-04-21T19:18:15.09577 user.notice: Apr 21 21:18:15 root: ACPI group/action undefined: jack/lineout / LINEOUT

  2025-04-21T19:18:15.98845 daemon.debug: Apr 21 19:18:15 rtkit-daemon[1368]: Supervising 0 threads of 0 processes of 1 users.
And yes! That is even better for configuration!

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#39

Post by mdaniel »

dimonomid wrote: post #26
nodesocket wrote: post #24

Very nice work. Anyway to specify a group of log files in the config that are shared across many hosts? For example: log_files: mygroup: - /var/log/syslog - /var/log/foo - /var/log/bar log_streams: myhost-01: hostname: actualhost1.com port: 1234 user: myuser log_files: mygroup myhost-02: hostname: actualhost2.com port: 7890 user: myuser log_files: mygroup myhost-03: hostname: actualhost3.com port: 8888 user: myuser l…

Thanks. And no, as of today, there's no way to define a group like that. Might be a viable idea though. However, before we go there, I want to double check that we're on the same page: this `log_files` field specifies only files _in the same logstream_; meaning, these files need to have consecutive logs. So for example, it can be ["/var/log/syslog", "/var/log/syslog.1"], or it can be ["/var/log/auth.log", "/var/log/a…

At the very grave risk of scope creep, I'll point out that the GP's yaml is very close to an Ansible inventory file so rather than just making up a new structure one could leverage any existing muscle memory (and create helpful defaults for folks who have not yet seen Ansible but have seen your tool)

https://docs.ansible.com/ansible/11/collections/ansible/buil...

e.g.

  all:
    children:
      mygroup:
        hosts:
          myhost-01:
            hostname: actualhost1.com
            port: 1234
            user: myuser
          myhost-02:
            hostname: actualhost2.com
            port: 7890
            user: myuser
          myhost-03:
            hostname: actualhost3.com
            port: 8888
            user: myuser
        vars:
          files:
          - /var/log/syslog
          - /var/log/foo
          - /var/log/bar
That first "children" key is because in ansible's world one can have "vars" and "hosts" that exist at the very top, too; the top-level "vars" would propagate down to all hosts which one can view as "not necessary" in the GP's example, or "useful" if those files are always the same for every single host in the whole collection. Same-same for the "user:" but I wasn't trying to get bogged down in the DRY for this exercise

Re: Show HN: Nerdlog – Fast, multi-host TUI log viewer with timeline histogram

#40

Post by lenova »

dimonomid wrote: post #37
mcint wrote: post #35

Earlier quoted context omitted.

Yeah, I'm bouncing for now on the localhost requirement. Or, on a related issue of not parsing my .ssh/config, a Match directive, and not wanting it to parse it yet. I grep'ed for an env var to override, but only USER and SSH_AUTH_SOCK are pulled in. I did go get install ...nerdlog/cmd/nerdlog-tui@latest just fine. Thanks for hacking in the open, and releasing early.

Sorry to hear you're having issues. I'll try to reproduce and fix the issue with the Match. Not sure if that "Thanks" for releasing early is sarcastic, but regardless, I appreciate the feedback.

I would say that their thanks is sincere, and that they're applauding you for releasing a new tool to a public/critical audience while also taking feedback in very constructive manner.
Post reply on HN