Sloggo

Sloggo is a lightweight log collection and exploration tool designed for small to medium-sized setups where users need real-time logs without the overhead of complex systems like the JVM or a full Kubernetes cluster. As a minimal RFC 5424 syslog collector and viewer based on DuckDB, it runs as a single, resource-friendly process, ingesting logs over TCP and UDP protocols and presenting them in a clean, modern web UI. This tool is ideal for environments with modest logging volumes, such as 10 daily lines of logs, where simplicity and efficiency are paramount. Its compressed size is less than 10 MiB, emphasizing its minimal footprint and ease of deployment via quick configuration through environment variables, making it accessible for developers and system administrators seeking straightforward log management.

Many small to medium-sized setups struggle with the complexity and resource demands of traditional log management systems like ELK, Loki, or Datadog, which often require spinning up extensive infrastructure just to handle minimal logging needs. This over-engineering creates unnecessary overhead, both in terms of configuration time and computational resources, diverting attention from core development or operational tasks. Sloggo addresses this pain point by offering a streamlined alternative that eliminates the need for a full Kubernetes cluster or JVM-based solutions, allowing users to focus on their primary work rather than log system maintenance. By targeting scenarios where lightweight, real-time log ingestion is sufficient, it reduces friction and operational costs, ensuring that logging does not become a bottleneck or a source of complexity in simpler environments.

One of Sloggo's major feature groups is its support for RFC 5424 log ingestion over TCP and UDP, with configurable ports via environment variables like SLOGGO_UDP_PORT and SLOGGO_TCP_PORT. It also supports RFC 3164 parsing through the SLOGGO_LOG_FORMAT variable, which can be set to 'auto' to try RFC 5424 first and fall back to RFC 3164, ensuring compatibility with various syslog standards. This flexibility allows users to integrate Sloggo with diverse systems that emit logs in different formats, providing a unified collection point without requiring extensive customization. The ingestion process is efficient, capable of handling up to 1 million logs per second, which, while not intended for massive-scale production, offers robust performance for its target use cases, ensuring reliable log capture in real-time.

Another key feature is the clean web UI built with data-table-filters React components from OpenStatus, enabling fast search, filtering, and tailing of logs. This interface presents collected logs in an organized manner, allowing users to quickly explore and analyze log data without needing command-line expertise or external tools. The UI supports real-time updates, so as new logs are ingested, they appear dynamically, facilitating immediate monitoring and troubleshooting. This visual approach enhances usability, making log management more accessible to team members who may not be deeply technical, while still providing the depth needed for developers to drill down into specific entries, timestamps, or message contents.