Home / Docs / CLI

Command-line workflows.

The CLI can start the terminal viewer, open a configured source directly, create an initial expression or Query Tab, send work to a running instance, or present piped output with pager-like chrome.

BASE logace [paths] [options]
HANDOFF app · tab · stream
HELP --help · -h
PAGER --pager
§ CLI·1 Commands viewer and process handoff

Choose where the new tab should open.

viewer
logace [path …] [options]
Start the current TUI process and open zero, one, or several file paths together with any configured non-file sources.
macOS
logace app [args …]
Open a new LogAce.app window and forward the remaining paths and options to its embedded viewer. The app bundle must already be registered with Launch Services.
running
logace tab <file …>
Send existing local files to the most recently discovered running LogAce command server. The command fails rather than starting another viewer when no instance accepts the request.
stdin
producer | logace stream [name]
Forward redirected stdin as chunks into a live spool-backed tab. The optional name becomes the tab label.
implicit
producer | logace
With redirected stdin and no other arguments, select the stream workflow automatically. Linux keeps it in the current process; macOS can forward it to the running app.
§ CLI·2 Common Options parsing, analysis, and view

Options shared across source types.

parsing and archivesshape input
--delimiter, -d <value>
--regex, -r <pattern>
--headers <a,b,c>
--archive-entry <path>
--sample-size <number>  # default 2000
--cache-size <number>   # default 4096
Delimiter and regex parsing create a Custom profile for the invocation. Headers replace inferred field names; archive-entry targets one file inside a supported bundle.
expression filterinitial view
--filter-expr <code>
--filter-expr-file <path>
--filter-expr-disable
Pass a compiled row predicate inline or from a file. The disable flag keeps stored text but opens it inactive.
query tabderived result
--query-source <source>
--query-text <code>
--query-file <path>
--query-mode <snapshot|live>
Open a derived Query Tab over a reopenable upstream source. Query Tabs cannot use another Query Tab as their CLI upstream.
viewerinitial chrome
--time-zone <local|utc>
--pager
--debug
--help, -h
Pager mode hides menu, tabs, frames, headers, and status chrome. Debug adds build and last-key details to the status area.
EXPRESSION SYNTAX → QUERY SYNTAX → PAGER CONTROLS →
§ CLI·3 Source Options grouped by integration

Select a source, then add its companion options.

Repeatable selectors can open multiple tabs. Companion options apply to sources from the same family in the current invocation.

Dockerdocker
--docker-container <id>  # repeatable
--docker-context <name>
--docker-tail <count|all>
--docker-since <value>
--docker-follow
SSH file and journalctlssh
--ssh-file <target:path>  # repeatable
--ssh-journalctl-service <target:unit>
--ssh-port <number>
--ssh-identity <path>
--ssh-tail <count|all>
--ssh-mode <recent|full>
--ssh-follow  --ssh-sudo
--ssh-journalctl-last <value>
--ssh-journalctl-info
--ssh-journalctl-debug
--ssh-journalctl-follow
iOS SimulatormacOS
--simctl-device <id|name|booted>
--simctl-app <bundle-id>
--simctl-process <name|pid>
--simctl-last <value>
--simctl-info
--simctl-debug
macOS unified log/usr/bin/log
--oslog
--oslog-predicate <expr>
--oslog-process <name|pid>
--oslog-subsystem <id>
--oslog-level <default|info|debug>
--oslog-last <value>
--oslog-follow
Android logcatadb
--logcat-device <serial|model|any>
--logcat-buffer <name>  # repeatable
--logcat-level <V|D|I|W|E|F>
--logcat-tag <tag>  # repeatable
--logcat-package <pkg>
--logcat-pid <pid>
--logcat-tail <count|all>
--logcat-follow
--logcat-clear
Kuberneteskubectl
--kubectl-pod <name>  # repeatable
--kubectl-context <name>
--kubectl-namespace <ns>
--kubectl-container <id>
--kubectl-all-containers
--kubectl-tail <count|all>
--kubectl-since <value>
--kubectl-follow
AWS CloudWatchaws
--cloudwatch-group <name>  # repeatable
--cloudwatch-profile <name>
--cloudwatch-region <name>
--cloudwatch-stream <prefix>
--cloudwatch-filter <pattern>
--cloudwatch-since <value>
--cloudwatch-follow
Azureaz
--azure-webapp <name>
--azure-resource-group <rg>
--azure-subscription <id>
--azure-slot <name>
--azure-workspace <id>
--azure-kql <query>
--azure-timespan <value>
App Service uses webapp + resource group. Log Analytics uses workspace + KQL.
GCP Cloud Logginggcloud
--gcloud-logging
--gcloud-project <id>
--gcloud-filter <expr>
--gcloud-freshness <value>
--gcloud-limit <number>
--gcloud-follow
OpenTelemetryOTLP/HTTP
--otel-logs
--otel-bind <address>  # 127.0.0.1
--otel-port <port>      # 4318
--otel-path <path>      # /v1/logs
Syslog sinkUDP + TCP
--syslog-bind <address>
--syslog-port <port>
--syslog-udp-port <port>
--syslog-tcp-port <port>
The shared port defaults to 5514. Separate UDP/TCP flags can enable only one transport or override the shared value.

Local Linux journalctl

The local systemd picker is an in-app action rather than a dedicated startup option. For scripted local use, pipe journalctl into LogAce; remote journalctl has the full SSH option family above.

Validate against the installed build

logace --help prints the exact option set and defaults shipped with the current executable.