logwatch

Real-time log viewer and tailer with filtering, highlighting, JSON parsing, and multi-file support. Detects file rotation automatically. Single binary, no dependencies.

Works on Windows, macOS, and Linux.

Features

• Tail multiple files -- watch several log files simultaneously with file labels
• Regex filtering -- include only lines matching a pattern
• Pattern highlighting -- highlight specific patterns with a colored background
• Auto-colorization -- errors (red), warnings (yellow), info (green), debug (dim)
• JSON log parsing -- pretty-print structured JSON log lines
• File rotation detection -- handles truncation and inode changes (logrotate-safe)
• Line rate counter -- display lines/sec throughput
• Output to file -- tee output to a file while viewing (ANSI stripped)
• Timestamp prefix -- optionally prepend timestamps to each line

Install

Binary download

Grab the latest binary from Releases and place it in your PATH.

Go install

go install github.com/jmsperu/logwatch@latest

Build from source

git clone https://github.com/jmsperu/logwatch.git
cd logwatch
make build

Cross-compile for all platforms:

make build-all    # outputs to dist/

Quick start

logwatch /var/log/syslog                  # tail a log file
logwatch -f "ERROR" /var/log/app.log      # show only ERROR lines

Usage

Basic tailing

logwatch /var/log/syslog
logwatch /var/log/app.log /var/log/auth.log    # tail multiple files
logwatch -n 50 /var/log/syslog                 # show last 50 lines then follow

Filtering

logwatch -f "ERROR" /var/log/app.log           # show only lines matching "ERROR"
logwatch -f "user=admin" /var/log/auth.log     # filter by regex pattern

Highlighting

logwatch -e "ERROR|FATAL" /var/log/app.log     # highlight ERROR and FATAL
logwatch -f "HTTP" -e "5[0-9]{2}" access.log   # filter HTTP lines, highlight 5xx codes

JSON mode

logwatch --json /var/log/app.json.log          # pretty-print JSON log lines

Rate counter

logwatch --rate /var/log/syslog                # show lines/sec in stderr

Output to file

logwatch -o /tmp/filtered.log -f "ERROR" /var/log/app.log   # save filtered output

Timestamps

logwatch -t /var/log/app.log                   # prefix each line with timestamp

Disable color

logwatch --no-color /var/log/syslog            # plain text output (for piping)

Flags reference

Flag	Short	Default	Description
--filter	-f		Regex pattern to filter lines (include matches only)
--highlight	-e		Regex pattern to highlight in output
--json		false	Parse and pretty-print JSON log lines
--rate		false	Show lines/sec rate counter
--output	-o		Write output to file while tailing (ANSI stripped)
--timestamp	-t	false	Prefix each line with a timestamp
--buffer	-b	65536	Read buffer size in bytes
--lines	-n	10	Number of lines to show from end of file initially
--no-color		false	Disable colorized output

Auto-colorization rules

Lines are colored based on keywords found in the text:

Keyword	Color
FATAL, PANIC	Bold red
ERROR, ERR	Red
WARN, WARNING	Yellow
INFO	Green
DEBUG, TRACE	Dim/gray

License

MIT