Jack Bister


Logsuck

Github link

Logsuck is a program which is similar to Splunk. It aggregates logs from multiple files into a database and lets you query the logs in different ways.

The reason I started working on Logsuck is because I use Splunk at work every day and think it is one of the best tools I use. But for my personal projects I feel like Splunk's licensing model is a problem, and I also wanted a program which is simpler to set up.

So Logsuck is a free, self hostable alternative to Splunk. I built it in Go, using SQLite with its excellent FTS extension as the database. I used Go because I really wanted to have a program which was deployable as a single executable and Go makes it easy to build such programs. The GUI, built in Preact, is bundled into the executable using Go's embed feature.

Logsuck can run both in a standalone mode where the same instance reads the log files and serves the GUI, or it can run in a "forwarder/recipient" mode where one instance receives logs from multiple forwarders. This means you can use it both in small deployments where you have a single server and in bigger deployments with multiple servers.