Command-line workflows.

The CLI can start the terminal viewer, open a configured source directly, create an initial expression or Query Tab, send work to a running instance, or present piped output with pager-like chrome.

BASE logace [paths] [options]

HANDOFF app · tab · stream

HELP --help · -h

PAGER --pager

Choose where the new tab should open.

viewer

logace [path …] [options]

Start the current TUI process and open zero, one, or several file or folder paths together with any configured non-file sources.

macOS

logace app [args …]

Open a new LogAce.app window and forward the remaining paths and options to its embedded viewer. The app bundle must already be registered with Launch Services.

running

logace tab <file …>

Send existing local files or folders to the most recently discovered running LogAce command server. The command fails rather than starting another viewer when no instance accepts the request.

stdin

producer | logace stream [name]

Forward redirected stdin as chunks into a live spool-backed tab. The optional name becomes the tab label.

implicit

producer | logace

With redirected stdin and no other arguments, select the stream workflow automatically. Linux keeps it in the current process; macOS can forward it to the running app.

Options shared across source types.

folder as one listlocal logs

--folder <path>
--folder-pattern '*.log;*.txt'
--folder-profile iis

A positional folder path also works. Default pattern: *.log. Auto detects IIS headers or filename hints; choose iis, raw, jsonl, or another profile explicitly. Files stay in filename order. Reload with Ctrl+Shift+R to rescan.

parsing and archivesshape input

--delimiter, -d <value>
--regex, -r <pattern>
--headers <a,b,c>
--archive-entry <path>
--sample-size <number>  # default 2000
--cache-size <number>   # default 4096

Delimiter and regex parsing create a Custom profile for the invocation. Headers replace inferred field names; archive-entry targets one file inside a supported bundle.

expression filterinitial view

--filter-expr <code>
--filter-expr-file <path>
--filter-expr-disable

Pass a compiled row predicate inline or from a file. The disable flag keeps stored text but opens it inactive.

query tabderived result

--query-source <source>
--query-text <code>
--query-file <path>
--query-mode <snapshot|live>

Open a derived Query Tab over a reopenable upstream source. Query Tabs cannot use another Query Tab as their CLI upstream.

viewerinitial chrome

--time-zone <local|utc>
--pager
--debug
--help, -h

Pager mode hides menu, tabs, frames, headers, and status chrome. Debug adds build and last-key details to the status area.

Expression syntax → Query syntax → Pager controls →

Select a source, then add its companion options.

Repeatable selectors can open multiple tabs. Companion options apply to sources from the same family in the current invocation.

Dockerdocker

--docker-container <id>  # repeatable
--docker-context <name>
--docker-tail <count|all>
--docker-since <value>
--docker-follow

SSH file and journalctlssh

--ssh-file <target:path>  # repeatable
--ssh-journalctl-service <target:unit>
--ssh-port <number>
--ssh-identity <path>
--ssh-tail <count|all>
--ssh-mode <recent|full>
--ssh-follow  --ssh-sudo
--ssh-journalctl-last <value>
--ssh-journalctl-info
--ssh-journalctl-debug
--ssh-journalctl-follow

iOS SimulatormacOS

--simctl-device <id|name|booted>
--simctl-app <bundle-id>
--simctl-process <name|pid>
--simctl-last <value>
--simctl-info
--simctl-debug

macOS unified log/usr/bin/log

--oslog
--oslog-predicate <expr>
--oslog-process <name|pid>
--oslog-subsystem <id>
--oslog-level <default|info|debug>
--oslog-last <value>
--oslog-follow

Android logcatadb

--logcat-device <serial|model|any>
--logcat-buffer <name>  # repeatable
--logcat-level <V|D|I|W|E|F>
--logcat-tag <tag>  # repeatable
--logcat-package <pkg>
--logcat-pid <pid>
--logcat-tail <count|all>
--logcat-follow
--logcat-clear

Kuberneteskubectl

--kubectl-pod <name>  # repeatable
--kubectl-context <name>
--kubectl-namespace <ns>
--kubectl-container <id>
--kubectl-all-containers
--kubectl-tail <count|all>
--kubectl-since <value>
--kubectl-follow

AWS CloudWatchaws

--cloudwatch-group <name>  # repeatable
--cloudwatch-profile <name>
--cloudwatch-region <name>
--cloudwatch-stream <prefix>
--cloudwatch-filter <pattern>
--cloudwatch-since <value>
--cloudwatch-follow

Azureaz

--azure-webapp <name>
--azure-resource-group <rg>
--azure-subscription <id>
--azure-slot <name>
--azure-workspace <id>
--azure-kql <query>
--azure-timespan <value>

App Service uses webapp + resource group. Log Analytics uses workspace + KQL.

GCP Cloud Logginggcloud

--gcloud-logging
--gcloud-project <id>
--gcloud-filter <expr>
--gcloud-freshness <value>
--gcloud-limit <number>
--gcloud-follow

OpenTelemetryOTLP/HTTP

--otel-logs
--otel-bind <address>  # 127.0.0.1
--otel-port <port>      # 4318
--otel-path <path>      # /v1/logs

Syslog sinkUDP + TCP

--syslog-bind <address>
--syslog-port <port>
--syslog-udp-port <port>
--syslog-tcp-port <port>

The shared port defaults to 5514. Separate UDP/TCP flags can enable only one transport or override the shared value.

Local Linux journalctl

The local systemd picker is an in-app action rather than a dedicated startup option. For scripted local use, pipe journalctl into LogAce; remote journalctl has the full SSH option family above.

Validate against the installed build

logace --help prints the exact option set and defaults shipped with the current executable.