Kelora

Kelora is a command-line tool for reading log files. It recognizes 20+ formats on its own — application logs, syslog, web server logs, JSON, CSV — and for any other format you describe the layout on the command line. It splits each line into named fields and lets you filter, count, and summarize them with short options. For logic the options can't express, it has a small scripting language.

Install Kelora Explore a log file

What using it looks like

Checkout is failing. This is the shop's application log, plain text (it's in the repository's examples/ folder, like every file in these docs):

2026-10-06 14:00:23,860 INFO  [http-nio-8080-exec-5] c.e.shop.CartController - cart 9684 updated (1 items)
2026-10-06 14:00:41,380 INFO  [http-nio-8080-exec-4] c.e.shop.CartController - cart 3569 updated (1 items)
2026-10-06 14:01:00,255 INFO  [http-nio-8080-exec-4] c.e.shop.CheckoutController - order 41670 placed in 667ms

Errors only, with the fields you want. Kelora recognized the format, so fields have names:

kelora examples/shop.log -l error -k ts,logger,msg -n 3

ts='2026-10-06 14:06:28,793' logger='c.e.shop.InventoryClient'
  msg='stock lookup for sku 914 failed: 503 Service Unavailable'
ts='2026-10-06 14:20:14,827' logger='c.e.shop.PaymentClient'
  msg='payment for order 44643 failed: timeout after 5000ms (provider=adyen)'
ts='2026-10-06 14:20:25,134' logger='c.e.shop.PaymentClient'
  msg='payment for order 46371 failed: timeout after 5000ms (provider=adyen)'

Which component fails?

kelora examples/shop.log -l error --freq logger

logger       (2 values):
  value                     count
  c.e.shop.PaymentClient       17
  c.e.shop.InventoryClient      2

What do the errors say? --drain groups messages that differ only in IDs and numbers:

kelora examples/shop.log -l error --drain -k msg

templates (2 items):
  17: payment for order <num> failed: timeout after <duration> (provider=adyen)
   2: stock lookup for sku <num> failed: <num> Service Unavailable

When did it start? One letter per event, one row per stretch of time:

kelora examples/shop.log -F levelmap

2026-10-06T14:00:23.860Z IIIIIIIIIIIIIIIIIIIIIIIIIIIIIEIIIIIIIIIIIIIIIWIIIIIIIII
2026-10-06T14:13:26.503Z IIIIIIWIIIIIIIIIIIIIIIIIWIIEEEEIIEEIIIEEEEEEIEIWEIIIIIE
2026-10-06T14:26:39.972Z EWIIEIIIIEIIIIIIWIIIIIIIIWIIIIIIIIIIIIIWIIIIIIIIIIIIIII
2026-10-06T14:39:42.915Z II

🔹 E = ERROR | I = INFO | W = WARN

The payment provider has been timing out since about 14:20. The guide starts from here.

Logs in your own format

When Kelora doesn't know a format, describe it right on the command line — with column names, a regex with named groups, or a script. This example names the columns and uses a short script to clean up one field:

[2024-09-05 08:00:06] (worker-4) INFO :: processed batch 750
[2024-09-05 08:00:22] (worker-2) ERROR :: lost connection to broker

kelora examples/jobs.log -n 2 -f 'cols:ts(2) worker level - *msg' \
  -e 'e.worker = e.worker.clip()'

ts='[2024-09-05 08:00:06]' level='INFO' msg='processed batch 750'
  worker='worker-4'
ts='[2024-09-05 08:00:22]' level='ERROR' msg='lost connection to broker'
  worker='worker-2'

ts(2) takes two words, - skips the ::, and *msg takes the rest; clip() trims the parentheses (the timestamp parses with its brackets on). Everything above — -l, --freq worker, --drain — then works the same. Get Logs into Shape covers all three approaches.

In short

• Install: brew install dloss/kelora/kelora, or one binary for Linux, macOS, and Windows (all options).
• Input: files, .gz and .zst, globs, or stdin: tail -F app.log | kelora -l error.
• Speed: Kelora favors flexibility over speed. Line filters (--keep-lines), level filters, and simple field comparisons are quick; parsing text formats, scripts, and most summaries are much slower. For large files, cut them down first — with rg, --keep-lines, or --since — or use --parallel for batch jobs (benchmarks).
• Scripting: Rhai, for what the options can't express: --filter 'e.status >= 500 && e.path.starts_with("/api")'.
• Video: a 5-minute introduction by the YouTube channel Hack the Clown.
• Compared with grep, awk, and jq: they are faster at what they do — grep and rg at finding lines, jq at reshaping JSON. Kelora's strength is reading a log as fields, whatever its format, with counting, grouping, and time windows built in. They combine well.

What it does

Topic	Covers
Get logs into shape	20+ formats detected automatically; your own via columns or a regex; stack traces and other multi-line events
Filter	by text, file section, time range, level, or any field; with surrounding lines like grep -C
Transform	computed fields, values pulled out of messages, one row per array element, masking and pseudonyms
Summarize	counts, percentiles, top values, distinct values, message patterns, comparing two logs
Group into spans	per-minute rollups, batches, sessions
Cross-event logic	deduplication, pairing requests with responses, gap detection
Big files	gzip/zstd, many files, merging by time, parallel processing

The Cookbook has ready-made commands for common questions.

About

Kelora is open source under the MIT License; a few included third-party files are under Apache-2.0. It runs locally: no networking, no telemetry, enforced by a CI check. The security policy lists this and the other safeguards, and where to send security reports.

Kelora is built with agentic AI development: AI agents write all implementation and tests, and I steer requirements (more). It is a single-developer spare-time project with best-effort support.