Features
What is built today.
Each section is the short form of a page in the engine’s docs, which say what is in, how it works and what is not there yet. Everything on this page is in the repository’s main branch; nothing is released.
Search
A query box with a time range, and under it what the search returned: a timeline and an event list for events, a grid with a chart above it for statistics.
- Global Sources shows every index with its event count, trend and newest event; a click on an index, sourcetype, host or source starts or narrows a search.
- Current Search lists the fields of the result and of the search's scope, with top values, Add to table and Count by.
- History keeps the searches the account ran, with their range and result, to run again.
- Results chart as lines, areas, columns, bars or a pie when the shape allows; a click on a category or a time bucket refines the search. CSV downloads the whole result.
- The compiler pushes what it can into one ClickHouse query and runs the rest in-process; every search runs under time, memory, scan and result limits derived from the host's RAM.
index=web status>=500 | stats count by host | sort -count | head 52000 x 1250
Ingestion
The engine owns Vector's configuration. Inputs and sourcetypes are small JSON documents; apply renders them into one vector.yaml, validates it with Vector and only then swaps it into place, so a bad input never takes ingestion down.
- Input types: syslog (udp or tcp), tcp and udp with text, JSON or NDJSON decoding, HEC, HTTP, file with multiline, journald.
- A sourcetype is a parsing recipe compiled to VRL: a decoder (json, syslog, kv, cef or regex), extra regex extractions, numeric conversion, a timestamp spec, a CIM mapping and verbatim VRL for the rest.
- Builtins for syslog, Linux auth, nginx and Apache access logs, JSON, key-value, CEF, journald and the platform's own logs. A custom file with the same name overrides a builtin.
- sourcetypes test replays sample lines through the same stages Vector runs in production and prints the fields each event ends up with.
- Secrets never appear in the generated configuration; Vector reads them from a 0600 secrets file through its file backend.
logline inputs add --type tcp --id nginx --port 5517 --index web --sourcetype nginx:access --host-from dns
logline sourcetypes test nginx:access --file sample.log
logline vector apply2000 x 1250
Dashboards
A grid of panels, each drawing one search: pie, bar, line and area charts, tables, gauges and single values, with base searches defined once and extended by the panels, and inputs that feed values into the searches as tokens.
- A drag-and-resize editor with a live preview per panel; saved on the server, so everyone who signs in sees the same dashboards.
- Two or more panels on the same base run it once as a search job and slice the result in the engine, one ClickHouse search per base rather than one per panel.
- Text and dropdown inputs, fixed or search-fed, drilldown from a slice into a search or into an input, and the range and input values in the URL so a link shares a filled-in view.
- Export and import as JSON, duplicate, CSV per panel, a present mode for a wall display, and Add to dashboard from the search page.
2000 x 1250
Health and self-monitoring
The Health page and logline doctor run the same checks from one implementation. The page adds the three services with restart and logs, host resources, ClickHouse's memory and table figures, the searches running now and ingest volume.
- Every check comes with a sentence and a remediation: self-logging, last night's backup and its timer, the search limits in effect against what ClickHouse applies.
- The engine runs unprivileged; restarts and journal reads go through a small root helper over a socket with an allowlist of the platform's own units. Every action is audited.
- The platform is data in itself: the engine's, Vector's and ClickHouse's logs are searchable as index=_internal, and every login, search, account and token change as index=_audit, with the request id tying the log line to the audit line.
index=_audit event=login action=failure | stats count by user, src2000 x 1250
Install and operations
One binary installs everything on an Ubuntu 22.04 or 24.04 host: pinned and checksum-verified ClickHouse and Vector, system users, hardened systemd units, a local CA, the schema and the first admin. Re-running it is safe.
- Preflight checks root, OS, architecture, systemd, RAM, disk, ports, clock and an existing install before anything changes.
- Memory limits for ClickHouse, Vector and every search are sized from the host's RAM; an operator overrides them in one file and re-runs the installer.
- A nightly backup takes an archive of the configuration and the engine's data together with a ClickHouse backup of the events table; restore verifies everything before writing and keeps the replaced table until you drop it.
- doctor exits 1 on any failing check; offline hosts install from a cache; a rehearsal mode writes every file on any OS without touching the host.
sudo ./logline install
logline doctor
sudo logline backup2000 x 1250
Auth
Local accounts are the first-run path, with SSO to come beside them. Passwords are hashed with argon2id, sessions are HttpOnly SameSite=Strict cookies, and every state-changing request from a cookie session needs a custom header the browser cannot add cross-site.
- Roles: admin, user and readonly. The last active admin cannot be demoted or deleted, and nobody can lock themselves out from the UI.
- Five failed logins lock the username and the client address for a minute, doubling with each failure up to an hour.
- API tokens are shown once and stored as hashes, prefixed ll_ so leaks are easy to find, with a search-only scope and an optional expiry.
- An append-only audit log records every login, search, account, token and service-control action with the request id of the HTTP request that caused it.
curl -H "Authorization: Bearer ll_..." -H "Content-Type: application/json" \
-d '{"query":"index=web | stats count by status","earliest":"-24h"}' \
https://logs.example.com/api/search2000 x 1250