{"id":15198712,"url":"https://github.com/fantasticmao/nginx-log-analyzer","last_synced_at":"2025-10-28T11:30:23.827Z","repository":{"id":45983724,"uuid":"423595301","full_name":"fantasticmao/nginx-log-analyzer","owner":"fantasticmao","description":"A lightweight (simplistic) log analyzer for Nginx.","archived":false,"fork":false,"pushed_at":"2023-11-26T18:34:28.000Z","size":4505,"stargazers_count":76,"open_issues_count":1,"forks_count":5,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-02-05T07:06:10.477Z","etag":null,"topics":["geoip","log-analysis","nginx"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc-by-sa-4.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fantasticmao.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-11-01T19:44:55.000Z","updated_at":"2025-01-03T02:21:28.000Z","dependencies_parsed_at":"2024-06-19T01:48:12.135Z","dependency_job_id":"eb7a1821-94b0-4ec8-9e00-691a84a1529c","html_url":"https://github.com/fantasticmao/nginx-log-analyzer","commit_stats":{"total_commits":50,"total_committers":1,"mean_commits":50.0,"dds":0.0,"last_synced_commit":"c8bc1ba6d2a74da924f1a3118cf0167125e79ce8"},"previous_names":["fantasticmao/nginx-json-log-analyzer"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fantasticmao%2Fnginx-log-analyzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fantasticmao%2Fnginx-log-analyzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fantasticmao%2Fnginx-log-analyzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fantasticmao%2Fnginx-log-analyzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fantasticmao","download_url":"https://codeload.github.com/fantasticmao/nginx-log-analyzer/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238638165,"owners_count":19505549,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["geoip","log-analysis","nginx"],"created_at":"2024-09-28T01:40:20.129Z","updated_at":"2025-10-28T11:30:22.968Z","avatar_url":"https://github.com/fantasticmao.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Nginx-Log-Analyzer\n\n[![Actions Status](https://github.com/fantasticmao/nginx-log-analyzer/workflows/ci/badge.svg)](https://github.com/fantasticmao/nginx-log-analyzer/actions)\n[![codecov](https://codecov.io/gh/fantasticmao/nginx-log-analyzer/branch/main/graph/badge.svg)](https://codecov.io/gh/fantasticmao/nginx-log-analyzer)\n![Go Version](https://img.shields.io/github/go-mod/go-version/fantasticmao/nginx-log-analyzer)\n[![Go Report Card](https://goreportcard.com/badge/github.com/fantasticmao/nginx-log-analyzer)](https://goreportcard.com/report/github.com/fantasticmao/nginx-log-analyzer)\n[![Release](https://img.shields.io/github/v/release/fantasticmao/nginx-log-analyzer)](https://github.com/fantasticmao/nginx-log-analyzer/releases)\n[![License](https://img.shields.io/github/license/fantasticmao/nginx-log-analyzer)](https://github.com/fantasticmao/nginx-log-analyzer/blob/main/LICENSE)\n\nREADME [English](README.md) | [中文](README_ZH.md)\n\n## What is it\n\nNginx-Log-Analyzer is a lightweight (simplistic) log analyzer, used to analyze Nginx access logs for myself.\n\nNginx-Log-Analyzer is written in Go programming language, needs only a 2 MB executable file to run, currently supported\nfeatures are as follows:\n\n- [x] Filter logs based on the request time\n- [x] Support multiple log format configurations\n    - combined (Nginx default configuration)\n    - JSON\n- [x] Analyze multiple files at the same time\n- [x] Analyze .gz compressed files\n- [x] Support a variety of [statistical indicators](#specify-the-analysis-type--t)\n\n### Advantages compared to [GoAccess](https://goaccess.io/)\n\nGoAccess is an excellent and powerful real-time web log analyzer, interactive viewer that runs in a terminal in \\*nix\nsystems or through your browser. But as far as I know, GoAccess seems does not support counting URI response time by\npercentile, Nginx-Log-Analyzer supports this feature.\n\nIf I knew about GoAccess before developing Nginx-Log-Analyzer, I might choose to use it directly. GoAccess is so\npowerful, I love GoAccess.\n\n### Advantages compared to [ELK](https://www.elastic.co/cn/what-is/elk-stack)\n\nAlthough ELK is powerful, it is troublesome to install and configure, and it also has certain requirements for machine\nperformance. Nginx-Log-Analyzer is more lightweight and easier to use, suitable for some simple log analysis scenarios.\n\n## Quick start\n\n### Installation\n\nJust download the binary executable file for the corresponding platform from the\nGitHub [Release](https://github.com/fantasticmao/nginx-log-analyzer/releases) page of Nginx-Log-Analyzer.\n\n#### GeoIP2 and GeoLite2\n\n[GeoIP2](https://www.maxmind.com/en/geoip2-city) is a commercial IP geolocation database, need to pay to use\nit. [GeoLite2](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data) is a free and low-precision version of\nGeoIP2, distribute by [Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en)\nlicense, download by logging in to the [MaxMind](https://www.maxmind.com/en/accounts/current/geoip/downloads) official\nwebsite.\n\nWhen using Nginx-Log-Analyzer, if you need to resolve the geographic location of the IP (that is, use the `-t 4`\nmode), then you will need to download the GeoIP2 or GeoLite2 City database file, save it to the `City.mmdb` file in the\ndefault configuration directory `${HOME}/.config/nginx-log-analyzer/`. The corresponding shell commands are as follows:\n\n```shell\n~$ mkdir -p ${HOME}/.config/nginx-log-analyzer\n~$ tar -xzf GeoLite2-City_20211109.tar.gz\n~$ cp GeoLite2-City_20211109/GeoLite2-City.mmdb ${HOME}/.config/nginx-log-analyzer/City.mmdb\n```\n\n#### Configure Nginx\n\nNginx-Log-Analyzer parses Nginx access logs in combined format by default, which means that the logs will contain the\nfollowing fields:\n\n- $remote_addr\n- $remote_user\n- $time_local\n- $request\n- $status\n- $body_bytes_sent\n- $http_referer\n- $http_user_agent\n\nWhen using Nginx-Log-Analyzer, if you need more types of [statistical indicators](#specify-the-analysis-type--t), then\nyou will need to use the `-lf json` option to specify the log parsing mode to the JSON format, and need to add the\nfollowing `log_format` and `access_log` directives in the Nginx configuration:\n\n```text\nlog_format json_log escape=json '{\"remote_addr\":\"$remote_addr\",'\n                                '\"time_local\":\"$time_local\",'\n                                '\"request\":\"$request\",'\n                                '\"status\":$status,'\n                                '\"body_bytes_sent\":$body_bytes_sent,'\n                                '\"http_user_agent\":\"$http_user_agent\",'\n                                '\"request_time\":$request_time}';\naccess_log /path/to/access.json.log json_log;\n```\n\n- The `log_format` directive can only appear in the `http` context;\n- The `access_log` directive could appear in the `http`, `server`, `location` context, and should use the `log_format`\n  declared above;\n- You can make multiple `access_log`s at the same time without deleting the original configuration. e.g.\n    ```text\n    access_log /path/to/access.log;\n    access_log /path/to/access.json.log json_log;\n    ```\n\nRelated document: http://nginx.org/en/docs/http/ngx_http_log_module.html\n\n### Command line options\n\n#### show version -v\n\nThe `-v` options show Nginx-Log-Analyzer's build version, build time, and Git Commit at build time.\n\n#### specify the configuration directory -d\n\nThe `-d` option specify the configuration directory that Nginx-Log-Analyzer required at runtime, the default value\nis `${HOME}/.config/nginx-log-analyzer/`.\n\n#### specify the log format -lf\n\nThe `-lf` option specify the log format parsed by Nginx-Log-Analyzer, available values are combined and json, the\ndefault value is combined.\n\n#### specify the analysis type -t\n\nThe `-t` option specify the type of this analysis, the analysis type and corresponding statistical indicators are as\nfollows:\n\n| Supported | Analysis Type `-t` | Statistical Indicators                                                           | Required Fields or Libraries                                                                                                                                     |\n| --------- | ------------------ | -------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| ✅        | 0                  | PV and UV                                                                        | $remote_addr                                                                                                                                                     |\n| ✅        | 1                  | Most visited IPs                                                                 | $remote_addr                                                                                                                                                     |\n| ✅        | 2                  | Most visited URIs                                                                | $request                                                                                                                                                         |\n| ✅        | 3                  | Most visited User-Agents                                                         | $http_user_agent                                                                                                                                                 |\n| ✅        | 4                  | Most visited user countries and cities                                           | $remote_addr, MaxMind [GeoIP2](https://www.maxmind.com/en/geoip2-city) or [GeoLite2](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data) City Database |\n| ✅        | 5                  | Most frequent response status                                                    | $status, $request                                                                                                                                                |\n| ✅        | 6                  | Largest average response time URIs                                               | $request, $request_time                                                                                                                                          |\n| ✅        | 7                  | Largest percentile response time URIs, e.g. p1(min), p50(median), p95, p100(max) | $request, $request_time                                                                                                                                          |\n\n#### limit the analysis start and end time -ta -tb\n\n`-ta` and `-tb` options are used to filter logs based on the request time, `ta` is the abbreviation of time after, `tb`\nis the abbreviation of time before.\n\n`-ta` and `-tb` options required the $time_local field in `log_format` directive of Nginx configuration.\n\n#### limit the output lines number -n -n2\n\n`-n` and `-n2` options are used to limit the number of output lines of Nginx-Log-Analyzer, `-n2` option only works\nin `-t 4` mode.\n\n#### specify the percentile value -p\n\nThe `-p` option specify the percentile value in the `-t 7` mode, the default value is 95.\n\n### Usages\n\n#### Filter logs based on the request time\n\n![image](docs/tatb.png)\n\n#### Analyze multiple files at the same time\n\n![image](docs/logs.png)\n\n#### Analyze .gz compressed files\n\n![image](docs/loggz.png)\n\n#### Count the most visited IPs\n\n![image](docs/t1.png)\n\n#### Count the most visited URIs\n\n![image](docs/t2.png)\n\n#### Count the most visited User-Agents\n\n![image](docs/t3.png)\n\n#### Count the most visited countries and cities\n\n![image](docs/t4.png)\n\n#### Count the most frequently response status\n\n![image](docs/t5.png)\n\n#### count the largest URI average response times\n\n![image](docs/t6.png)\n\n#### count the largest URI percentile response times\n\n![image](docs/t7.png)\n\n## FQA\n\nQ: Will it support real-time analysis in the future?\n\nA: No. If you want this feature, it is recommended to use solutions such as GoAccess, ELK, Grafana + Time Series DBMS.\n\n## License\n\nGeoLite2 Database [License](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data#license)\n\nNginx-Log-Analyzer [License](https://github.com/fantasticmao/nginx-log-analyzer/blob/main/LICENSE)\n\nCopyright (c) 2021 fantasticmao\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffantasticmao%2Fnginx-log-analyzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffantasticmao%2Fnginx-log-analyzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffantasticmao%2Fnginx-log-analyzer/lists"}