AI ERP with agents inside the systems you run
AI phone and voice agents for real calls
LLM.coPrivate, self-hosted LLM deployments
Legal AI infrastructure for firms
AI RFP discovery and response drafting
Automatic.coBusiness process automation
CyberAttack.aiThreat detection and defense
Secure AI virtual data roomshl
hl is a fast command-line tool written in Rust that transforms JSON and logfmt logs into readable human-friendly output. It handles large log files efficiently with filtering, sorting, and live-follow capabilities while maintaining minimal performance overhead.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | pamburus/hl |
| Owner | pamburus |
| Primary language | Rust |
| License | MIT — OSI-approved |
| Stars | 3.2k |
| Forks | 64 |
| Open issues | 11 |
| Latest release | v0.36.3 (2026-06-12) |
| Last updated | 2026-07-06 |
| Source | https://github.com/pamburus/hl |
What hl is
A high-performance Rust-based log processor supporting JSON and logfmt input formats with features including field-based filtering, timestamp-range queries, automatic log-level filtering, multi-file sorting at ~2 GiB/s scan speed, and live follow mode. Integrates with external pagers (less) and offers comprehensive CLI customization via config files and environment variables.
Get the hl source
Clone the repository and explore it locally.
git clone https://github.com/pamburus/hl.gitcd hl# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- Requires external pager (less recommended) for interactive use; Windows users should install via Scoop to auto-include compatible less.
- Configuration via files and environment variables; review theme and field-visibility defaults for your log schema before production deployment.
- Timezone handling defaults to UTC; use -Z or -L flags or configure defaults to match your operational logs for consistent timestamp interpretation.
- Live follow mode (-F) and indexing (-s) perform best on local or high-bandwidth-accessible filesystems; network latency may degrade performance.
- Performance claims (~2 GiB/s) are stated for initial scan and re-indexing; actual performance depends on log complexity, CPU, and I/O bandwidth.
When to avoid it — and what to weigh
- Logs not in JSON or logfmt format — hl targets structured log formats. While --allow-prefix handles non-JSON prefixes, unstructured plain-text logs require preprocessing or a different tool.
- Binary log format requirements — This tool is text-stream oriented. Binary or proprietary log formats (e.g., Windows Event Log, syslog binary) are not supported natively.
- Need for log aggregation/centralization — hl is a local CLI viewer/processor, not a centralized logging platform. For enterprise log aggregation, use dedicated services like ELK, Splunk, or Datadog.
- Windows pager integration reliability — README explicitly notes pager compatibility issues on Windows (WinGet less build breaks ANSI sequences), requiring manual workaround with Scoop or Chocolatey.
License & commercial use
MIT License. Permissive OSI-approved license allowing commercial use, modification, and distribution with minimal restrictions (retain license notice).
MIT is a permissive license that explicitly permits commercial use. No license review blocking commercial deployment as a CLI tool. However, verify any Rust dependencies (transitive Cargo dependencies) for conflicting licenses in your compliance process.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Active |
| Documentation | Adequate |
| License clarity | Clear |
| Deployment complexity | Low |
| DEV.co fit | Good |
| Assessment confidence | High |
hl processes local log files as a CLI tool; no network exposure or authentication by design. Input is unstructured JSON/logfmt from files or stdin—no injection vectors evident. Rust memory safety mitigates buffer overflows. No audit trail or logging of tool operations. Review: ensure log files themselves are not world-readable if containing secrets, and use OS-level permissions for access control.
Alternatives to consider
humanlog (Go)
Similar purpose (JSON to human-readable), but hl demonstrates faster performance per README benchmarks; humanlog may suit environments without Rust ecosystem preference.
jq (JSON processor)
General-purpose JSON CLI tool with more flexibility but steeper learning curve; hl is specialized for log viewing with built-in filters and pager integration, making it simpler for log-specific tasks.
ELK Stack / Splunk (centralized logging)
If you need log aggregation, search, alerting, and dashboard capabilities across distributed systems, centralized platforms are required; hl is local-only.
Build on hl with DEV.co software developers
hl offers fast, local log processing with powerful filtering. If you're scaling log infrastructure across teams or evaluating centralized logging, talk to Devco about DevOps strategy and tooling.
Talk to DEV.coRelated on DEV.co
Explore the category and the services that help you build with it.
hl FAQ
Can hl process logs from stdin in a pipeline?
Does hl support regex or complex field filtering?
What is the performance on Windows?
Can hl replace our log aggregation platform?
Build it with a software development company
DEV.co is a software development company with a dedicated AI development practice. Whether hl is a component or the centerpiece, we design the surrounding open-source observability architecture and ship it.
Need a log analysis tool optimized for your DevOps workflow?
hl offers fast, local log processing with powerful filtering. If you're scaling log infrastructure across teams or evaluating centralized logging, talk to Devco about DevOps strategy and tooling.