Open-Source Observability · tstack

lnav

lnav is a terminal-based log file viewer that automatically detects log formats, merges multiple files by timestamp, and provides a searchable interface with error highlighting. It handles compressed files, decomposes JSON logs, and enables SQL-based filtering without requiring external tools.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/tstack/lnav

10.4k

GitHub stars

389

Forks

C++

Primary language

BSD-2-Clause

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	tstack/lnav
Owner	tstack
Primary language	C++
License	BSD-2-Clause — OSI-approved
Stars	10.4k
Forks	389
Open issues	287
Latest release	v0.14.0 (2026-04-12)
Last updated	2026-07-04
Source	https://github.com/tstack/lnav

What lnav is

C++14 TUI application using SQLite for analysis, PCRE2 for regex filtering, and libarchive for compressed log handling. Supports systemd-journald integration, real-time tailing with file rename tracking, and embedded SQL querying via hotkeys. Statically-linked binaries available for Linux/macOS/Windows.

Quickstart

Get the lnav source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/tstack/lnav.git2cd lnav3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Multi-file log correlation and root cause analysis

Merge syslog, web access, application logs by time; jump to errors with semantic highlighting (IPs, PIDs); use SQL queries to correlate events across files without manual grepping.

DevOps log tailing and monitoring

Watch multiple log directories in real-time, follow renames, auto-detect new files, and instantly filter via regex or SQLite expressions. Reduce context-switching between grep/tail/less.

Structured log exploration and visualization

Pretty-print JSON-lines, view histograms of message frequency over time, highlight patterns, and analyze with embedded SQL—ideal for modern microservices logging.

Implementation considerations

Install via package manager (Homebrew macOS, pkg FreeBSD) or download statically-linked binary from GitHub releases—no build required for most users.
For source builds, pre-install dependencies (PCRE2, SQLite 3.9.0+, zlib, bz2, libcurl 7.23.0+, libarchive, libunistring, Rust/cargo). Run ./autogen.sh then ./configure && make.
Verify log format detection with `lnav` on a sample file; custom formats may require format definition in lnav's SQL/Lua configuration language.
For systemd-journald integration, pipe journalctl output directly: `journalctl -o json | lnav`. Use `-n` or `--since` to limit large journals for performance.
Performance scales with log file size. For very large archives, pre-filter or compress logs before opening in lnav to avoid indexing delays.

When to avoid it — and what to weigh

Require enterprise SLA or vendor support — lnav is community-maintained. Support channels are email, GitHub discussions, and Discord; no commercial support contract is available.
Need remote/centralized log aggregation — lnav is a local terminal tool for individual machines or SSH sessions. For centralized log collection, use Splunk, ELK, Datadog, or similar.
Working exclusively on Windows without WSL — Binaries are available for Windows, but native terminal support is limited. Windows users should evaluate compatibility needs before adoption.
Require extensive custom plugins or scripting — lnav has limited extensibility. Custom log formats must be configured via SQL or Lua; no native plugin API beyond built-in configuration.

License & commercial use

BSD 2-Clause (Simplified) license. Permissive OSI-approved license allowing commercial use, modification, and distribution with minimal restrictions (retain copyright notice and disclaimer).

BSD 2-Clause is a permissive open-source license compatible with commercial use. However, verify your organization's compliance requirements. No warranty is provided by the licensor; users assume all liability. Sponsorship via GitHub is optional but encouraged.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Strong
License clarity	Clear
Deployment complexity	Low
DEV.co fit	Good
Assessment confidence	High

Security considerations

lnav does not transfer information to remote systems without explicit user request (see Code Signing Policy). Processes local or piped log files in-memory/via SQLite. Code signing by SignPath Foundation. No public security advisories found in data. Recommend reviewing for untrusted log inputs; regex and SQL expressions execute locally and are not sandboxed.

Alternatives to consider

ELK Stack (Elasticsearch, Logstash, Kibana)

Centralized, scalable log aggregation with web UI. Better for multi-node, high-volume environments; requires infrastructure and operational overhead.

Splunk

Enterprise log analytics platform with advanced search, dashboards, and alerts. Proprietary and costly; suitable for organizations requiring vendor support and compliance.

tail, grep, less (Unix utilities)

No dependencies, available on all Unix systems. Lack semantic understanding of logs, cannot merge files by time, and do not handle structured data or compression.

Software development agency

Build on lnav with DEV.co software developers

Download lnav from GitHub, try the online SSH demo, or review the documentation. No installation friction—start analyzing multi-file logs in seconds.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

tslog clp logtape

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Observability DevOps Custom Software Development Talk to DEV.co

lnav FAQ

Can lnav analyze logs from multiple machines at once?

Not directly. lnav is a local TUI tool. You can SSH into a machine or pipe remote logs via SSH, but it is not a centralized log aggregation platform. For multi-machine scenarios, use Splunk, ELK, or cloud logging services.

Does lnav support custom log formats?

Yes, via SQL and Lua configuration. lnav auto-detects common formats (syslog, JSON-lines, nginx, Apache). Custom formats must be defined in lnav's format definition language; see documentation for examples.

What are the performance limits?

lnav indexes logs in memory and via SQLite. Performance depends on log file size and regex/SQL query complexity. For multi-GB files, pre-filter or compress; very large indices may slow TUI responsiveness.

Is lnav suitable for automation or CI/CD pipelines?

lnav is primarily interactive. It can be used in scripts via stdin piping, but lacks machine-readable output (JSON, CSV) for automation. For CI/CD log analysis, prefer grep, jq, or specialized log processing tools.

Custom software development services

Need help beyond evaluating lnav? DEV.co is a software development agency offering software development services and web development for teams of every size. Our software developers and web developers build custom software, web applications, APIs, and open-source observability integrations — and maintain them long-term.

Ready to streamline your log analysis?

Download lnav from GitHub, try the online SSH demo, or review the documentation. No installation friction—start analyzing multi-file logs in seconds.

Talk to DEV.co Schedule a Consultation