pre-releaseThe schema and the APIs may still change and no upgrade path is promised yet.
Centralized logging on one host, searched with SPL-compatible syntax.
Logline is one Go binary with Vector for ingestion and ClickHouse for storage. One command turns an Ubuntu host into a running server with pinned, checksum-verified downloads, hardened systemd units, a local CA and the first admin account.
2400 x 1500
What it is
One host
Everything runs on a single Ubuntu 22.04 or 24.04 host as four systemd services. No cluster to operate, and ClickHouse never listens off loopback.
How it is installedOne binary
The search engine, the web UI, inputs management, health, authentication and the installer are one Go binary. Vector ingests, ClickHouse stores.
The designSPL-compatible search
Real SPL syntax, compiled to ClickHouse SQL and verified against a query corpus. The compatibility matrix says what is in and where it differs.
Compatibility matrixApache 2.0
Open source, built from open-source pieces, with the rules that keep it independent written down.
How to contribute
A search, one stage at a time
Each command after a pipe takes the previous result. The engine pushes what it can into one ClickHouse query and runs the rest in-process; the result shape is what the API returns. Figures are illustrative.
index=web status>=500Events in the web index whose status field is 500 or more, newest first. The comparison is numeric because the value parses as a number.
events3,093 events, newest first
- 2026-11-07 14:02:11host=web-02
10.0.0.12 - - [07/Nov/2026:14:02:11 +0000] "GET /api/orders HTTP/1.1" 502 157 "-" "curl/8.5.0" - 2026-11-07 14:02:09host=web-05
10.0.0.40 - - [07/Nov/2026:14:02:09 +0000] "POST /checkout HTTP/1.1" 504 0 "https://shop.example/cart" "Mozilla/5.0" - 2026-11-07 14:02:08host=web-02
10.0.0.12 - - [07/Nov/2026:14:02:08 +0000] "GET /api/orders HTTP/1.1" 502 157 "-" "curl/8.5.0"
Where it stands
Phase 0 (the parser, planner and SQL compiler, verified against ClickHouse with a query corpus) and phase 1 (inputs and sourcetypes compiled to a validated Vector configuration, the search UI, local accounts with argon2id passwords and API tokens, the installer, health, self-logging, dashboards with export and import, a search jobs API and backups) are in.
The repository’s own words are “Nothing here is ready for use.” There is no release yet; the changelog lists merged pull requests and the roadmap lists the open issues.