Home / Docs / Input sources

Input sources.

LogAce can read a stable file, run a snapshot command, follow a growing source, or bind a local listener. F2 shows the source types available on the current platform; the CLI exposes the same source families for scripts and repeatable workflows.

OPEN F2 · File menu · CLI
MODES file · snapshot · follow · listener
PARSING source-aware profiles
STATE source-dependent
§ SRC·1 Catalog all current source families

Choose the source, then shape the view.

Each source opens as a normal LogAce tab. A source may suggest a matching profile, but F8 can still switch the parser afterward.

01·file
Local files
Open one or more paths directly. LogAce builds a line index and reads records from disk instead of importing the whole file into a separate database.
02·archive
Gzip and archive entries
.gz is decompressed into a cache spool. For .zip, .tar, .tar.gz, and .tgz, choose one contained file or pass --archive-entry.
03·stdin
Redirected stdin
Pipe a command into LogAce or use stream [name] to label the live tab. macOS can hand the stream to a running app; Linux keeps it in the current TUI and uses /dev/tty for interaction.
04·ssh
Remote files over SSH
Open [user@]host:/absolute/path through the system SSH client. Choose recent-tail or full-snapshot mode, port, identity, optional sudo -n, preload count, and live follow.
05·ssh-j
Remote journalctl over SSH
Choose a systemd service on a remote host, set the recent range and priority level, and optionally follow the journal live.
06·journal
Local journalctl on Linux
F2 or Ctrl+J opens one local unit or all services. Configure tail count, a --since range, and follow mode. This picker is available only on Linux.
07·docker
Docker container logs
Choose a Docker context and container, preload a count or all records, pass a since value, and follow output across container restarts.
08·k8s
Kubernetes pod logs
Choose context, namespace, pod, and one or all containers. Configure tail, since, and follow behavior through the installed kubectl.
09·sim
iOS Simulator logs
On macOS, import a structured unified-log snapshot from a booted simulator and narrow it by app bundle id, process, time range, and info/debug level.
10·logcat
Android logcat
Use adb to select a device or emulator, buffers, minimum priority, tags, package or PID, initial tail, optional clear, and live follow.
11·oslog
macOS unified log
Read a host snapshot or run log stream. Filter by NSPredicate, process, subsystem, level, and recent time range.
12·aws
AWS CloudWatch Logs
Use the active AWS CLI configuration to select a group, profile, region, stream prefix, filter pattern, and since range, then snapshot or follow.
13·azure
Azure App Service and Log Analytics
Follow App Service output by app, resource group, subscription, and slot, or run a KQL snapshot against a Log Analytics workspace and timespan.
14·gcp
GCP Cloud Logging
Use the active gcloud account and project with a logging filter, freshness window, result limit, and snapshot or follow mode.
15·otel
OpenTelemetry OTLP/HTTP logs
Bind an HTTP listener for OTLP logs. The default endpoint is 127.0.0.1:4318/v1/logs; address, port, and path are configurable.
16·syslog
UDP/TCP syslog sink
Listen on a shared port or separate UDP and TCP ports. The live tab auto-detects RFC 3164 or RFC 5424 and adds receive time, sender, transport, facility, and severity metadata.
§ SRC·2 Source Behavior snapshot, follow, listener

The source mode determines how the tab grows.

Stable file or snapshot

Local files read from their backing path. Command-backed snapshots materialize their current result into a cache spool that behaves like a normal indexed log.

Follow

Live sources append to a spool and refresh the grid. When the viewport is already at the end, it stays pinned to the newest logical record.

Listener

OTLP and syslog sources bind local network endpoints. The selected bind address controls whether senders outside the host can reach them.

External tools and credentials

SSH, Docker, adb, kubectl, aws, az, and gcloud integrations reuse the installed system commands and their normal configuration rather than maintaining another credential store.