▸ Open huge logs without waiting on an editor.

Point LogAce at a file, archive, SSH target, container, or stream and start moving through it. Keep filters, bookmarks, layout, and sessions with the log so the next pass starts where the last one ended.

01 · INPUTS
Open logs where they are
files, archives, SSH, containers, mobile devices, cloud logs, syslog, stdin, and macOS unified logs
02 · TAB STATE
Keep your place per log
each tab remembers filters, bookmarks, columns, highlights, encoding, layout, and parser profile
03 · ANALYSIS
Ask sharper questions
use expression filters, Rows() query tabs, virtual columns, grouped summaries, and exports when search is not enough
04 · RETURN PATH
Reopen the same investigation
sticky .las state, recent history, named sessions, desktop app, and CLI entry points bring the workspace back
●LIVE · 4.1M rows ready in 1.8s
files · archives · SSH · streams · containers · syslog
macOS · Linux · Windows
desktop app + CLI
quick start · macOS
.app 
# open the release DMG
Open LogAce-*.dmg
Drag LogAce.app to Applications
Launch LogAce once

# optional: from the app menu
LogAce > Install Command Line Tool...

# then pipe a macOS log stream straight in
/usr/bin/log stream --style ndjson \
  --level info | logace
[ ↓ ] DOWNLOAD MANUAL →
WHEREAS
· $ less requires a finished file
· $ tail -f forgets context on rotate
· VS Code refuses files past ~2 GB
· logace just opens it.
LogAce showing an nginx error log with filters, selected rows, and row detail
§ 01 Inputs twelve built-in

Open anything that produces a line.

Open the log from wherever you found it: disk, archive, SSH, Docker, kubectl, CloudWatch, Azure, GCP, syslog, stdin, Android logcat, iOS simulator, or the host macOS unified log. Pick it from the UI or pass the same source on the CLI; LogAce chooses a sensible parser and keeps your place for next time.

▸ FILE 
┌──────┐
│ ░░░░ │
│ ░░░░ │
└──────┘
Local files
Plain logs plus .gz, .zip, .tar, .tar.gz, and .tgz. Pick an entry, auto-detect encoding, and reopen later with your place and settings intact.
▸ SSH 
┌──────┐
│ ssh> │
│ log  │
└──────┘
Remote SSH logs
Open remote files or journalctl services through system ssh. Tail live, reconnect after restarts, use sudo -n, and browse remote paths without copying logs down first.
▸ STDIN 
  │ │ │
  ▼ ▼ ▼
┌────────┐
│  >_    │
└────────┘
Piped streams
Pipe command output into LogAce or add it to a running window. Useful for one-off shell pipelines and logs that do not live in a file yet.
▸ DOCKER 
╭──╮ ╭──╮
│░░│ │░░│
╰──╯ ╰──╯
═════════
   ~~~~
Docker containers
Choose a container by Docker context, tail from a time window, follow live output, and reconnect after stop/start cycles.
▸ K8S 
   ╱╲
  ╱  ╲
 ╱ ◆◆ ╲
╱──────╲
Kubernetes pods
Choose context, namespace, pod, and container. Follow live logs and resume from a timestamp when the stream reconnects.
▸ SIM 
┌──────┐
│ ▢▢▢▢ │
│ ▢▢▢▢ │
│  ──  │
└──────┘
iOS simulators
macOS unified log import from a booted simulator, with app/process filters and time window.
▸ LOGCAT 
   \  /
    ..
  .----.
 /| oo |\
/_|____|_\
  /_/\_\
Android logcat
Open a connected device or emulator through adb. Filter by buffer, level, tag, package, PID, tail count, or follow live with reconnect.
▸ OSLOG 
╭─╮ ╭─╮
│ │ │ │
╰─┼─┼─╯
╭─┼─┼─╮
│ │ │ │
╰─╯ ╰─╯
macOS unified log
Open the host macOS unified log as a snapshot or live stream, with predicate, process, subsystem, level, and time window controls.
▸ AWS 
 .----.
(  __  )
 `-..-'
   ││
  ▁▃▆█
   ▼
AWS CloudWatch Logs
Browse a log group, stream prefix, region, and profile through the system aws CLI. Run snapshots or follow live with a since range.
▸ AZURE 
    /\
   /  \
  / /\ \
 /_/  \_\
   ╲╱
   ▼
Azure logs
Open App Service live streams or Log Analytics snapshots through az, using the active Azure CLI account and optional subscription or slot.
▸ GCP 
 .----.
/  __  \
| /  \ |
| \__/ |
\____/
 ══›
GCP Cloud Logging
Open Google Cloud Logging through gcloud with project browse, logging filter, freshness, limit, snapshot, or follow mode.
▸ SYSLOG 
═══›››› ┐
═══›››› │
═══›››› ┘
udp+tcp
Live syslog sink
UDP+TCP listener for live syslog traffic, with automatic framing and format detection.
§ 02 Features 18 workflows that matter

The bits that turn it into your daily driver.

Every tab keeps its parser, filters, bookmarks, encoding, layout, and saved state. Close a log, reopen it, and pick up where you left off. When the built-ins are not enough, teach LogAce your format, add expression filters, and open query tabs instead of reshaping the log outside the tool.

01·scale
Huge files without import
Open very large logs directly, jump around quickly, and keep the file on disk instead of loading it all into memory.
02·view
Multiline logs stay readable
Stack traces and embedded newlines can wrap or expand without flattening every record into one long line.
03·parse
Parsers per tab
Each log can use its own parser, columns, filters, bookmarks, and view settings. Use a built-in profile or save your own.
04·filter
Quick filters before code
Include, exclude, and narrow columns with text or time filters first. Header markers show which columns are shaping the view.
05·expr
Filters for real conditions
Use expressions when simple search is not enough: parsed numbers, time windows, optional fields, nearby rows, and helper functions. See examples →
06·search
Full-text over filtered view
Ctrl+F runs against what is currently visible. Literal or regex, forward or backward.
07·query
Summary tabs from the current view
Group, count, order, trim, and keep the result as another normal tab. Run it once or keep it live when the source keeps growing. See examples →
08·mark
Bookmarks that survive filtering
Mark exact log lines, name them, and come back after filter changes, parser swaps, or reloads.
09·merge
Merge tabs into one timeline
Combine selected tabs, sort by UTC, and keep the original columns intact.
10·follow
Live tails that survive restarts
Follow containers, pods, remote journals, cloud logs, syslog, device logs, unified logs, and piped streams. Reconnect when sources restart and stay pinned to new rows.
11·hi
Highlight rules per log format
Color important rows by profile, promote temporary rules, and keep defaults for recurring formats.
12·time
Typed timestamp columns
F9 swaps local ↔ UTC, Go To jumps by time, and time-aware filters work on parsed values instead of raw text.
13·state
Reopen the same workspace
Position, profile, filters, bookmarks, encoding, and layout come back when you reopen the same log.
14·session
Named sessions + recent history
Save reopenable tab sets, reopen them additively, and jump back into local or remote logs without rebuilding your workspace.
15·adhoc
Reusable custom parsers
Delimiter, regex, or fixed-width parsing with multiline grouping. Save the result as your own reusable profile.
16·virtual
Dynamic virtual columns
Turn existing fields into new ones without preprocessing first: Ip → Country, UserAgent → Browser/Bot, Query → SessionId, Time → 1m bucket, plus hostnames, URL parts, regex captures, query params, coalesce, and concat.
17·archive
Archive entries without unpacking
Open .gz directly, or pick one entry from a .zip, .tar, .tar.gz, or .tgz bundle. The CLI can target the entry explicitly with --archive-entry.
18·export
Export exactly what you filtered
Ctrl+S writes the current view as text, RFC 4180 CSV, or JSON Lines.
Shipped · Ctrl+Shift+F
Expression filters
Write filters for cases text search cannot express: time windows, optional fields, parsed numbers, nearby lines, and reusable helpers.
OPEN DOCS →
Shipped · Ctrl+Q
Query tabs
Turn the log you are viewing into a grouped count, one-row summary, latency table, or continuously updating filtered tab.
OPEN DOCS →
§ 03 Profiles built-in + custom parsing

Built-in profiles plus your own parsing.

Pick one with F8. Save your own with F5. Ad Hoc can be delimiter, regex, or fixed-width, with multiline grouping and dynamic virtual columns, then promoted into a reusable profile when a one-off format turns into a recurring problem.

JSONLbuilt-in
{"ts":"14:23:01.482","lvl":"INFO",
 "svc":"api","msg":"Started handler",
 "trace_id":"b7c3…91a","status":200}
Inferred columns. Capped dedicated set + Other column joining the rest as path: value lines.
Dockerbuilt-in
2026-05-20T14:23:01.482Z  INFO   scope=api
2026-05-20T14:23:01.611Z  WARN   retry 2
2026-05-20T14:23:02.001Z  ERROR  job 47291 failed
Splits RFC3339 prefix into a typed datetime. Follow with reconnect after stop/start.
Kubectlbuilt-in
2026-05-20T12:15:00.044Z app    /api/v2/users/482
2026-05-20T12:15:00.118Z envoy  mTLS handshake ok
2026-05-20T12:15:00.331Z app    /api/v2/orders 201
Parses --timestamps prefix. Single-container or all-containers per pod.
Spring Bootbuilt-in
14:23:01.984  ERROR  worker-pool-04
  o.s.web.client.ResourceAccessException
    Read timed out; SocketTimeoutException
Fixed columns. Joins multiline stack traces until the next ISO timestamp.
Apache / Combinedbuilt-in
10.0.4.12 - radek [20/May/2026:14:23:01 +0200]
  "POST /api/v2/orders HTTP/1.1" 201 4128
  "https://logace.dev/" "Mozilla/5.0 …"
Typed Time + IP, User, Status, Size, Request, Referrer, UserAgent columns.
IIS / W3Cbuilt-in
#Fields: date time s-ip cs-method cs-uri sc-status
2026-05-20 14:23:01 10.0.4.12 POST /api/v2/orders 201
2026-05-20 14:23:02 10.0.4.12 GET  /healthz       200
Columns read dynamically from #Fields. - shown as empty cells.
NGINX Errorbuilt-in
2026/05/20 14:23:01 [error] 1284#0:
  *48217 upstream timed out (110: Connection
  timed out) while reading response header
Date, Time, Level, PID, Message + multiline continuation.
Syslog Sinkbuilt-in
<14>1 2026-05-20T14:23:01Z host-3 worker
   - - [exampleSDID@32473 iut="3"] backoff
RemoteIp=10.0.4.12  PRI=14  Facility=user
Understands classic and structured syslog. Adds sender, transport, and severity metadata automatically.
Merged Timelinedynamic
Date         Time          Source       Msg
2026-05-20  14:23:01.482   api.log      Started…
2026-05-20  14:23:01.984   worker.log   Job 47291…
2026-05-20  14:23:02.001   db.log       pool empty
Multi-select tabs → Merge. Interleaved by UTC, with original columns kept intact.
Ad Hocper-file
delimiter = "|"  or  regex = "\s+"
columns:
  Timestamp   | datetime=yyyy-MM-dd HH:mm:ss.fff
  Status
  Ip
  UserAgent
  Country     | source=Ip        | virtual=geoip-country
  Class       | source=Status
              | virtual=http-status-class
  Bot         | source=UserAgent | virtual=ua-bot
Delimiter / regex / fixed-width. Optional record-start regex, typed timestamps, and virtual columns that turn one parsed line into a richer table.
§ 04 Controls keyboard + mouse controls

Keyboard-first, but not keyboard-only.

Click the bottom status bar to open menus, switch tabs, select rows, and reach the same dialogs you use from shortcuts. When your hands are already on the keyboard, the same log workflow is still one key away.

Use the mouse when it is faster

The status bar works as a menu, rows can be selected directly, and common dialogs are reachable without memorizing keys first.

Keep repetitive work on shortcuts

Navigation, source opening, tab switching, filters, query tabs, bookmarks, highlights, exports, and sessions all have keyboard paths.

Full reference
Keyboard map
See the complete shortcut list grouped by navigation, open sources, tabs, view, find, expressions, query, bookmarks, highlights, and sessions.
OPEN DOCS →
§ 05 macOS App LogAce.app

Open logs from Finder, Dock, or the terminal.

LogAce.app adds the macOS entry points you expect: Finder launch, Dock launch, file associations, menu bar actions, and an installable logace CLI. The viewer, profiles, shortcuts, and sessions stay the same.

  • Drop a .log on the dock — opens with the right profile.
  • Install a logace command line tool from the app menu.
  • Import iOS simulator unified logs by simulator, app, or process on macOS.
  • LogAce tab file.log sends another log into the running window.
  • Signed releases can update in place.
  • The same shortcuts and profiles work in Terminal and in the app.
Finder + Dock Use normal macOS entry points.

Open a log from Finder, drop one on the Dock icon, or bring back a recent source without changing how the viewer works.

Same workspace Profiles, filters, bookmarks, and sessions stay portable.

A log opened from the app uses the same parser profiles and saved state as one opened from the terminal.

CLI handoff Send files and streams into the running app.

Install the bundled logace command, then open another file or pipe a stream into the current window when that is faster.

§ 06 Downloads direct builds · three platforms

Download the build for your platform.

LogAce ships as direct downloads, not package-manager formulas. macOS can install the bundled logace CLI from the app; Linux and Windows run from extracted archives. Release 0.2.0 is linked below together with checksums.txt.

macOS.app · DMG
# install from the DMG
Open LogAce-0.2.0-osx-arm64.dmg
Drag LogAce.app to /Applications
Launch it once from Finder or Dock

# optional CLI wrapper from the app menu
LogAce > Install Command Line Tool...
logace /var/log/api.log

# or open directly in the desktop app
open -a LogAce --args /var/log/api.log
Apple Silicon DMG Intel DMG
Linuxtar.gz · deb · rpm
# portable archive
tar -xzf logace-portable-0.2.0-linux-x64.tar.gz
cd logace-portable-linux-x64
./LogAce /var/log/nginx/access.log

# systemd straight in
journalctl -u nginx -f | ./LogAce

# package builds
sudo apt install ./logace_0.2.0-1_amd64.deb
sudo rpm -i ./logace-0.2.0-1.x86_64.rpm
Portable x64 Portable arm64 .deb amd64 .deb arm64 .rpm x86_64 .rpm arm64
Windowszip
# unpack the archive
Expand-Archive .\logace-cli-win-x64.zip .
cd .\logace-cli-win-x64

# run the viewer
.\LogAce.exe C:\logs\app.log

# PowerShell pipe
Get-Content -Wait app.log | .\LogAce.exe
Windows x64 ZIP
CLI opendirect
logace /var/log/api.log
logace /tmp/log-bundle.zip --archive-entry logs/api/current.log
logace --ssh-file prod-api:/var/log/app.log --ssh-follow
logace --ssh-journalctl-service prod-api:nginx.service --ssh-journalctl-follow
logace --docker-container api --docker-follow
logace --kubectl-pod web-7d6f --kubectl-follow
logace --simctl-device booted --simctl-last 30m
logace --syslog-port 5514
Pipesstdin
# into a running instance
/usr/bin/log show --last 5m --info --style ndjson | logace
kubectl logs deploy/api -f | logace stream api
tail -f /var/log/foo.log | logace
docker compose logs -f | logace
journalctl -f | logace stream systemd
State dirswhere it lives
# macOS
~/Library/Application Support/LogAce/
~/Library/Caches/LogAce/
~/Library/Application Support/LogAce/file-sources/  # hashed .las mode

# Linux
$XDG_STATE_HOME/logace/
$XDG_CACHE_HOME/logace/
$XDG_STATE_HOME/logace/file-sources/  # hashed .las mode

# Windows
%LOCALAPPDATA%\LogAce\
%LOCALAPPDATA%\LogAce\State\file-sources\  # hashed .las mode