v0.3.0

What's new

Parenthesised query groups

OR and AND can now be combined with explicit grouping:

(level=error OR level=warn) AND service=payments
(service=payments OR service=auth) AND message contains "timeout"
level=error AND (tag=production OR tag=staging)

Case-insensitive level matching

level=ERROR, level=Error, and level=error all return the same rows and hit the same index. Implemented via a functional expression index (idx_level_norm ON log_entries(lower(level))). Existing databases pick it up automatically on first open — no migration step.

Benchmarked at 100k rows: all three case variants run in ~51 ms, identical within measurement noise.

Pagination

# CLI
logdive query 'level=error' --limit 50 --offset 100

# HTTP API
curl 'http://127.0.0.1:4000/query?q=level%3Derror&limit=50&offset=100'

Distroless Docker runtime

Runtime stage changed from debian:bookworm-slim to gcr.io/distroless/cc-debian12:nonroot — no shell, no curl, no root (uid 65532).

The healthcheck no longer depends on curl. logdive-api now has a --health-check flag that TCP-connects to its own port and exits 0/1:

HEALTHCHECK CMD ["/usr/local/bin/logdive-api", "--health-check"]

---

Breaking changes

Area	Change	Migration
Library	execute() / execute_at() third parameter changed from Option<usize> to QueryOptions { limit, offset }	Pass QueryOptions { limit: Some(n), offset: None }
CLI	logdive query --format renamed to --output	Replace --format with --output in scripts
Docker	Healthcheck: curl GET /version → logdive-api --health-check	Update compose / k8s probes

---

Performance

Criterion benchmarks against a 100k-row SQLite index (Acer Nitro 5, Linux). Four new benchmark groups added in this release covering every new feature.

Operation	Result
Indexed-field query, zero result	23 µs
Indexed-field query, 25% match, LIMIT 1000	~49 ms
JSON field query, 25% match, LIMIT 1000	~4.1 ms
JSON field query, 0% match — full table scan	~69 ms
CONTAINS full-table scan	~35–38 ms
OR query, 2-branch 50% match	~68 ms
Parenthesised group (A OR B) AND C, 12.5%	~45 ms
Case-insensitive level — all three case variants	~51 ms (identical)
Pagination deep page overhead (offset 2450 vs 0)	+8 ms
Batched ingest, 10k rows	~189k rows/s
Parse + ingest end-to-end, 10k rows	~150k rows/s

Binary sizes (release profile, stripped): 3.9 MB (logdive), 4.2 MB (logdive-api).

Run cargo bench to reproduce on your own hardware.

---

Test suite

417 tests across 9 test binaries — all pass.

---

Install

Cargo:

cargo install logdive        # CLI
cargo install logdive-api    # HTTP server

Docker (GHCR):

docker pull ghcr.io/aryagorjipour/logdive:0.3.0
docker run -p 4000:4000 -v "$PWD/data:/data" ghcr.io/aryagorjipour/logdive:0.3.0

Prebuilt binaries: see assets below.

---

What's next — v0.4.0

Performance focus: extend benchmark suite to 500k rows, query latency improvements on the indexed path. Also planned: --output yaml / --output csv, Windows --follow, configurable retention by source tag.