LogsQL – opinionated query language for logs

Hacker News

Share card

LogsQL – opinionated query language for logs

I don't like the existing query languages for Elasticsearch and Grafana Loki, because they are too awkward to use for typical logs' investigation cases. So I designed new query language - LogsQL - and wrote reference implementation for it as a part of VictoriaLogs - an open source database for logs. LogsQL is based on the following principles: - Simplicity. It is easy to write typical queries over logs in it. For example, a single word `error` is a valid LogsQL query, which returns all the logs with the `error` word. Another example is `_time:5m error`, which returns all the logs with the 'error' word over the last 5 minutes. - Composable building blocks similar to Unix pipes, which allow powerful filtering, transforming and calculating stats over the selected logs. For example, `_time:5m error | stats count() as rows` returns the number of logs with the `error` word over the last 5 minutes. - Readability. Typical LogsQL queries must be easy to read and understand even for persons unfamiliar with it. Take a look at LogsQL docs [1] and try using VictoriaLogs [2] in production. If you like Unix way and KISS design principle, then you'll enjoy LogsQL :) [1] https://docs.victoriametrics.com/victorialogs/logsql/ [2] https://docs.victoriametrics.com/victorialogs/