Self-hosted logsearch Web-GUI

Web frontend for searching and monitoring logfiles, as standalone script without requiring the overhead of a database or involving any other daemon.

For smaller or self-hosted scenarios, stacks for log management such as Loki/Grafana, Elasticsearch ELK, or Graylog are often overkill – in especially for low volume logs, or on limited hardware such as on a Raspberry Pi. The standard setup is still a syslog daemon that writes local plaintext files, possibly extended with forwarding from a journal and log rotation with compression. This also still allows to centrally collect logs from multiple machines very easily with no additional software required for a bit more advanced use-cases.

This the initial approach and now legacy predecessor of the Syslog Search and Statistics Dashboard project, which maintains a structured log file storage on its own.

The alternative here is a simple python script that opens a web server for a frontend that can list and search plaintext or compressed files in a local log directory. For occasionally reviewing logs, it can thus easily be self-hosted with no dependencies and no additional overhead for maintaining/indexing a database.

Builtin HTTP server with Basic authentication and HTTPS support
Web frontend responsive to desktop and mobile browsers
No database or other daemon involved, searching through local files on-demand
Decompression of .gz files on-the-fly
Support for multiple log directories
All only with a default Python 3.8 installation, as single self-contained script, and with no dependencies

Searching via regular expressions, which can be negated
Clutter-free frontend with sidebar toggle
Search in multiple files, result limits, and head/tail mode
Grouping, sorting, and live-filter for filenames

Please note that the builtin python HTTP server should not be considered safe for production use in general. Therefore, if not deployed strictly internal or only for trusted clients, an additional reverse proxy setup is recommended.

Usage

No installation is needed, as the single python script is completely self-contained, i.e. comprises HTTP Server, vanilla HTML/CSS/JS, and the search API. Also, no additional dependencies or requirements are needed, except for plain Python 3.8.

usage: logsearch-http.py [-h] [--verbose] [--localhost] [--port PORT] [--auth USER:PASS] [--ssl-cert CERT.PEM] [--ssl-key KEY.PEM] [--file-limit NUM] [--mtime-sort] LOGDIR [LOGDIR ...]

Logsearch HTTP Server and Web-GUI

positional arguments:
LOGDIR               directory containing log files to crawl

optional arguments:
-h, --help           show this help message and exit
--verbose            enable debug logging (default: False)
--localhost          bind to localhost only (default: False)
--port PORT          port to bind to (default: 8080)
--auth USER:PASS     enable HTTP Basic authentication (default: None)
--ssl-cert CERT.PEM  enable HTTPS server (default: None)
--ssl-key KEY.PEM    certificate keyfile (default: None)
--file-limit NUM     limit number of per-prefix shown log files (default: None)
--mtime-sort         sort log files by modification time (default: False)

In order to start the logsearch GUI at http://127.0.0.1:8080/, use for example:

./logsearch-http.py --localhost /var/log

Not all shown logfiles might actually be readable for your current user, so running the script as root (or syslog or adm) for example via sudo might be needed.