goaccess

Analyze one or more log files in interactive mode

$ goaccess [path/to/logfile1 path/to/file2 ...]

$ goaccess [path/to/logfile] --log-format=[format]

$ tail [[-f|--follow]] [path/to/logfile] | goaccess -

$ goaccess [path/to/logfile] [[-o|--output]] [path/to/file.html] --real-time-html

goaccess [options] [log-files...]

-f, --log-file=FILE
    Path to one or multiple log files

-o, --output=FILE
    Output file; formats: HTML, JSON, CSV, or terminal

--log-format=FORMAT
    Log format: COMBINED|COMMON|VCOMMON|W3C|IIS|etc.

--date-format=FMT
    strptime date format, e.g., '%d/%b/%Y'

--time-format=FMT
    strptime time format, e.g., '%H:%M:%S'

-d, --date-spec=CHR
    Log date field spec: HOUR|DAY|MONTH|YEAR

-t, --time-spec=CHR
    Log time field spec: HOUR|MIN|SEC|MS|US

--real-time-html
    Enable live HTML file updates

--daemonize
    Daemonize the process (with -o HTML)

-p, --persist
    Enable data persistence across sessions

--config-file=FILE
    Path to configuration file

-M, --methods
    Include HTTP methods panel

--static-file
    Enable static file panel

--with-output-resolver
    Resolve reverse DNS on IPs

-g, --geoip-database=FILE
    Path to MaxMind GeoLite/GeoIP database

--json=FILE
    Output metrics as JSON

--csv=FILE
    Output metrics as CSV

-L, --log-agent
    Disable user-agent parsing

-c, --count-lines
    Count lines processed

-V, --version
    Display version info

-h, --help
    Show help

GoAccess is an open-source, command-line tool for real-time analysis and interactive visualization of web server access logs. It features a curses-based terminal interface with maximal colors, displaying live statistics on visitors, requests, bandwidth, referrers, geolocation, and more.

Supporting formats include Apache (combined/common), Nginx, IIS, and custom regex-based logs. Panels cover unique visitors, top URLs, static files, OS/browsers, HTTP status codes, and response times. It processes logs from files, stdin (e.g., with tail -f), or FIFOs.

Output options generate static HTML/JSON/CSV reports for browsers or APIs. Lightweight and database-free, it's ideal for sysadmins monitoring traffic without heavy tools like AWStats or Matomo.

Features persistence for sessions, real-time HTML updates, and MaxMind GeoIP integration. Fast parsing handles millions of lines efficiently.

Requires terminal with 256-color support for optimal display.
High memory usage on massive logs (>1GB).
Real-time mode (--real-time-html) needs polling interval config.
Custom formats demand precise regex/date specs.

tail -f /var/log/nginx/access.log | goaccess --log-format=COMBINED -o report.html --real-time-html

Default: ~/.goaccessrc or /etc/goaccess/goaccess.conf. Supports time-based formats, panels, ignores, etc.

Interactive terminal (default), HTML (browser), JSON (API), CSV (spreadsheets)

Created by Gerardo Pazo in 2010 as a lightweight log viewer. Initial release focused on Apache logs; evolved with Nginx/IIS support, HTML output (v0.8, 2013), JSON/CSV (v1.0+), and GeoIP v2 (2016). Actively maintained on GitHub with 10+ years of updates.

tail(1), awk(1), grep(1), awstats(1), webalizer(1)