Log Aggregation & Search

Collect, index, and search logs from any source. Label-based indexing, full-text search, LogQL-compatible queries, structured logging, and real-time live tail.

Get Started View Source

Features

Everything you need for log management at any scale.

📥

Multi-Source Ingestion

HTTP push API (JSON, NDJSON, raw text), syslog receiver (RFC 5424/3164), and file tail agent with glob patterns and rotation detection.

🏷

Label-based Indexing

Loki-compatible label-based architecture. Logs organized into streams by label set, with efficient chunk storage and zstd compression.

🔍

Full-text Search

Inverted index with bloom filters and trigram indexing for fast full-text search across all stored log data.

📊

LogQL Queries

Complete LogQL support: stream selectors, line filters, parsers (JSON, logfmt, regex), label filters, range aggregations, and vector aggregations.

⚡

Live Tail

Real-time log streaming via WebSocket with dynamic filter updates, pause/resume, and auto-reconnect.

🔔

Alerting

Pattern matching, thresholds, rate changes, and absence detection. Notifications via webhook, Slack, email, and PagerDuty.

⚙

Processing Pipeline

Configurable stages: parse, filter, transform, route, and output. Built-in parsers for JSON, logfmt, regex, syslog, Docker, and Apache/Nginx.

🏢

Multi-tenant

Organization isolation with per-tenant quotas, retention policies, and independent label namespaces.

💾

Flexible Storage

Local filesystem or S3-compatible object storage. Time-based and size-based retention with automatic compaction.

Quick Start

Up and running in seconds.

Start the server

klog serve --config koder.toml

Push logs

# Push from stdin
echo "Application started successfully" | klog push --labels "job=myapp,level=info"

# Push JSON
curl -X POST https://log.koder.dev/api/v1/push \
  -H "Content-Type: application/json" \
  -d '{"streams":[{"stream":{"job":"nginx"},"values":[["'$(date +%s)000000000'","GET /api 200 OK"]]}]}'

Query logs

# Simple query
klog query '{job="nginx"}'

# Filter by content
klog query '{job="nginx"} |= "error"' --from 1h

# Parse JSON and filter
klog query '{job="app"} | json | status >= 500'

# Rate calculation
klog query 'rate({job="nginx"} |= "error" [5m])'

Live tail

klog tail '{level="error"}'

API Reference

REST API with Loki-compatible push format.

MethodEndpointDescription
POST/api/v1/pushPush log entries (JSON, NDJSON, raw text)
GET/api/v1/queryInstant LogQL query
GET/api/v1/query_rangeRange query with step interval
GET/api/v1/labelsList all label names
GET/api/v1/label/{name}/valuesList values for a label
GET/api/v1/streamsList log streams
GET/api/v1/tailWebSocket live tail
GET/api/v1/alertsList alert rules
POST/api/v1/alertsCreate alert rule
DEL/api/v1/alerts/{id}Delete alert rule
GET/api/v1/statsServer statistics
GET/metricsPrometheus metrics
GET/healthHealth check

LogQL Query Language

Powerful queries compatible with Grafana Loki.

Stream Selectors

{job="nginx"}                      # Exact match
{job="nginx", level="error"}       # Multiple labels
{job=~"nginx|apache"}              # Regex match
{host!~"dev-.*"}                   # Regex not match

Pipeline Stages

{job="app"} |= "error"                                    # Line contains
{job="app"} | json | status >= 500                        # Parse JSON + filter
{job="app"} | logfmt | duration > 1s                      # Parse logfmt + filter
{job="app"} | regexp "(?P<method>\\w+) (?P<path>\\S+)"   # Regex extraction
{job="app"} | json | line_format "{{.method}} {{.path}}"  # Format output

Aggregations

count_over_time({job="nginx"}[5m])                        # Count in window
rate({job="nginx"} |= "error" [5m])                       # Error rate
sum by (job) (rate({level="error"}[5m]))                   # Group by job
topk(10, sum by (path) (rate({job="nginx"}[5m])))          # Top 10 paths