Nerdlog: A Fast, Remote-First TUI Log Viewer for Multiple Hosts
Summary
Nerdlog is an efficient, remote-first TUI log viewer designed for monitoring logs across multiple hosts without requiring a central server. It offers a timeline histogram for quick visual insights and excels at querying large log files from various sources like syslog or journalctl. This tool provides a lightweight yet powerful alternative to more complex log management solutions.
Repository Info
Tags
Click on any tag to explore related repositories
Introduction
Nerdlog is a fast, remote-first, multi-host Terminal User Interface (TUI) log viewer with a timeline histogram and no central server. Loosely inspired by tools like Graylog and Kibana, it aims to provide similar functionality without the associated bloat or complex setup. It's laser-focused on efficiently querying logs from multiple remote machines simultaneously, allowing users to filter by time range and patterns, while also drawing an interactive timeline histogram for quick visual insight.
Primary use cases include reading system logs from files such as /var/log/messages or /var/log/syslog, or directly from journalctl, across one or more remote hosts. Nerdlog is highly efficient, even when dealing with large log files of 1GB or more.
Design Highlights
- No Centralized Server: Nerdlog establishes SSH connections to each node, keeping them idle in the background. All log analysis is performed on the remote nodes, and only filtered data (up to 250 messages per logstream and timeline histogram data) is downloaded, significantly reducing bandwidth.
- Efficient Data Transfer: Most data is gzipped in transit, further saving bandwidth.
- Flexible SSH: Supports arbitrary commands to establish shell sessions, making it compatible with tools like Teleport.
Here's a quick demo showing Nerdlog in action across four remote nodes:
Installation
The easiest way to get started with Nerdlog is by using a prebuilt binary for your platform. These can be found on the releases page.
Alternatively, if you have Go installed, you can build it from source.
Linux Specific Requirement: On Linux, the X11 development package (libx11-dev) is required for clipboard access. On Ubuntu, you can install it with:
sudo apt install libx11-dev
No extra dependencies are required on MacOS and Windows (for the client app).
Using go install
To install the latest release:
go install github.com/dimonomid/nerdlog/cmd/nerdlog@latest
To install the latest master branch:
go install github.com/dimonomid/nerdlog/cmd/nerdlog@master
By default, this installs the nerdlog binary to $HOME/go/bin.
Using make
To build and install nerdlog to /usr/local/bin:
make && sudo make install
To build and run without installing:
make && bin/nerdlog
Examples
When you launch the nerdlog application, it presents a query edit form. A core concept is 'logstreams', which define how Nerdlog connects to and reads logs from various sources. Logstreams can be local or remote, accessed via SSH.
By default, Nerdlog checks for /var/log/messages, then /var/log/syslog, and finally journalctl.
Basic Logstream Configuration:
For a server myserver.com accessible via SSH on port 22, reading default log files:
myuser@myserver.com
For a different port and/or specific log file:
myuser@myserver.com:1234:/some/other/logfile
To explicitly use journalctl:
myuser@myserver.com:1234:journalctl
Multiple logstreams can be provided, separated by commas:
myuser@myserver.com, myuser@anotherserver.com:1234:/some/other/logfile
Nerdlog also reads your SSH configuration (~/.ssh/config) and supports glob patterns for host definitions. For more advanced configurations, you can use Nerdlog's own logstreams config file at ~/.config/nerdlog/logstreams.yaml.
UI and Commands:
The UI includes an Awk pattern input for filtering logs, a time range histogram for visual insights, and a Vim-like command line for advanced operations. For example:
:xc[lip]: Copies a command string to the clipboard, allowing you to share or re-run specific queries. This is similar to sharing a URL in web-based logging tools. The string might look like:nerdlog --lstreams 'localhost' --time -3h --pattern '/something/':back/:fwd: Navigate through query history.:refresh: Rerun the current query.:e[dit]: Open the query edit form.
Why Use Nerdlog?
Nerdlog offers a compelling alternative to more resource-intensive log management solutions. Its remote-first architecture means no central server is required, simplifying deployment and reducing infrastructure overhead. By performing log analysis on remote nodes and minimizing data transfer, it ensures high efficiency, even when dealing with vast amounts of log data across many machines.
Designed for speed and efficiency, Nerdlog provides a powerful TUI experience with features like an interactive timeline histogram, making it easy to spot trends and anomalies. The project, initially developed in 2022 and open-sourced in 2025, has been rigorously tested across various Linux distributions, FreeBSD, MacOS, and Windows (client-side). It is considered production-ready, making it a robust tool for DevOps professionals and system administrators seeking a lean, effective log viewer.