WHAT IS IT?
GoAccess is a real-time web log analyzer that runs either inside a terminal or in a browser through a self-contained HTML report. Feed it an Apache, Nginx, CloudFront or pretty much any common log format and it spits out an interactive dashboard right away: top URLs, HTTP status codes, countries, user agents, bandwidth, response times.
WHY IS IT INTERESTING?
- Genuine real-time: the HTML report updates over WebSocket (1s refresh), the terminal view at 200ms. No cron job, no ELK pipeline to babysit.
- One dependency: ncurses. Compile, drop a binary, done. A world away from running an ELK or Loki stack.
- Self-contained HTML report: a single HTML file with no external assets, perfect to email or host as a static artifact.
- Handles large logs: optional on-disk persistence, incremental processing, multi-threading via
--jobs. Multi-GB log files go through without drama. - Zero config: it auto-detects common log formats and renders a useful dashboard in one command. Fine-grained config stays there when you need it.
USE CASES
- Quick audit of a web server over SSH without deploying a full observability stack
- Static HTML traffic report to share with a client or a team
- Anomaly detection (404 spikes, bots, suspicious ASNs) live on a reverse proxy
- Lightweight monitoring for side projects or VPS where Grafana/Loki would be overkill
- Incident post-mortem from archived log files