Repolode
Submit
tstack

tstack/lnav

A terminal log file viewer that merges, follows, and searches multiple log files with SQL and regex support.

Open-source alternative to:Splunk

View on GitHubWebsite
Stars
10,754
Forks
414
Open issues
297
Last commit
4 days ago

What is it?

lnav is a log file viewer that runs in the terminal. Given files or directories, it decompresses them as needed, detects their format, and merges entries from multiple files into one view ordered by time. It keeps following files as they grow, handles renames, and picks up new files that appear in watched directories.

In its interactive interface, lnav lets you jump between errors and warnings, search and filter with regular expressions or SQLite expressions, and highlight patterns. Structured lines such as JSON-lines can be pretty-printed, and a histogram shows message volume over time. Log messages can also be queried with SQLite directly from within the viewer.

It is a practical replacement for chaining tail, grep, and less when you need to work across several logs at once. Installation is available as a static binary for Linux, macOS, and Windows, and through Homebrew and FreeBSD packages.

Key features

  • 01Merges multiple files and directories into a single view sorted by time.
  • 02Decompresses files and detects log formats automatically.
  • 03Follows file growth and renames, and picks up new files in watched directories.
  • 04Filters and searches with regular expressions or SQLite expressions.
  • 05Pretty-prints JSON-lines and provides a histogram of messages over time.
  • 06Lets you run SQL queries against log messages within the viewer.

Use cases

  • Investigating errors across several server logs at once.
  • Reading rotated or compressed log archives without manual decompression.
  • Watching live logs while jumping between warnings and errors.
  • Piping journalctl output into a navigable view.

Quick start

  1. 1

    Install lnav with Homebrew on macOS

    brew install lnav
  2. 2

    Install lnav on FreeBSD

    pkg install lnav
  3. 3

    Or download a statically-linked binary for Linux, macOS, or Windows from the releases page

  4. 4

    Point lnav at your log files or directories

    lnav /path/to/file1 /path/to/dir

Things to know

  • Building from source needs many dependencies, including PCRE2, SQLite, libcurl, libarchive, and a Rust toolchain.
  • Reading pcap files depends on Wireshark's tshark program.

Topics

#log-analysis#terminal#tui#logging#command-line-tool#sqlite#less#log-monitor#log-viewer#log-visualization

FAQ

What is lnav?
A terminal log file viewer that merges, follows, and searches multiple log files with SQL and regex support. lnav is a log file viewer that runs in the terminal. Given files or directories, it decompresses them as needed, detects their format, and merges entries from multiple files into one view ordered by time. It keeps following files as they grow, handles renames, and picks up new files that appear in watched directories.
Is lnav free to use? What license does it have?
lnav is open source under the BSD-2-Clause license. Check the license terms before using it in commercial products.
Is lnav still maintained?
Actively maintained. The last commit to lnav was on Oct 18, 2026.
What can I use lnav for?
Investigating errors across several server logs at once. Reading rotated or compressed log archives without manual decompression. Watching live logs while jumping between warnings and errors. Piping journalctl output into a navigable view.
How do I install lnav?
Install lnav with Homebrew on macOS: brew install lnav Install lnav on FreeBSD: pkg install lnav Or download a statically-linked binary for Linux, macOS, or Windows from the releases page Point lnav at your log files or directories: lnav /path/to/file1 /path/to/dir
Where can I get lnav?
The source code and installation instructions are on GitHub: https://github.com/tstack/lnav

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects