How fast is log ingestion and querying?

Loguro supports 45,000 req/s ingestion on a single node and 400,000+ logs/s in batch mode. Queries on 50M+ logs return in under 500ms using DuckDB and Apache Parquet columnar storage.

Do I need to learn SQL or a custom query language?

No. Loguro uses a human-readable filter syntax: level:error message:"payment" from:yesterday to:today. No SQL, no Lucene, no regex.

What is Forever Memory?

When you create a task from a log, Loguro normalizes the message pattern and automatically recognizes any similar log in the future, showing a badge with occurrence count and first-seen date. The original log is stored permanently in Parquet — it never expires, regardless of your plan.

What is Incident Replay?

Select a time range on the chart and press Replay. Logs stream in exact chronological order at 1x, 2x, 4x, or 10x speed with original time distances preserved. You can see the warning 2 minutes before a crash, the cascade across services, and the recovery — as a narrative, not a flame graph.

Can I create Jira or Linear tickets directly from a log?

Yes. Use --task:jira, --task:linear, or --task:github from the log detail view or filter bar. Loguro automatically attaches the log message, context, timestamp, trace ID, and a deep link back to the log.

Is there a free plan?

Yes, Loguro has a free plan. Paid plans are available for higher ingestion limits and additional features. Visit logu.ro/pricing for current pricing.

Client SDK

any language

Lightweight HTTP client. Auto-batches, retries with backoff.

transport HTTPS

batch auto

Ingest API

edge gateway

Single + batch endpoints. Per-route auth, quota gating.

throughput 45k/s

p99 <12ms

Auth Layer

token validation

Three-layer cache. Memory → Redis → Postgres.

cache L1 + L2

hit rate 99.4%

Quota Engine

atomic counters

Per-project rate limits. Atomic increment, instant 429.

window rolling

enforce atomic

Request Trace

ULID propagation

End-to-end correlation across every service hop.

id ULID

Ingest Stream

durable queue

Append-only log. Multiple consumers, exactly-once delivery.

backend Redis Streams

retention 7d

Ingest Worker

native processor

Async task graph. Parses, validates, fans out to storage + analytics.

runtime native

tasks concurrent

Compaction

tier merger

Rolls hot blocks into cold tier. Idempotent, crash-safe.

tier L0 → L1

safety atomic swap

Alert Worker

pattern matcher

Subscribes to ingest events. Matches against active rules.

latency <200ms

dedup cooldown

Hot Tier

columnar store

Per-minute blocks. Sharded by project + time. Hyper-fast scans.

format columnar

granularity minute

Cold Tier

merged archive

Hourly + daily rollups. Long retention, query-optimized.

retention 30d / 1y

compression zstd

Query Engine

analytical reader

Scans 50M rows under 500ms. Predicate pushdown, vectorized exec.

scan 50M / 500ms

engine vectorized

Analytics

aggregator

Incremental rollups. Cardinality estimates, percentile sketches.

distinct HLL++

pct t-digest

Rollup Sink

time-bucketed

Daily + hourly aggregates. Write-once, read-many.

buckets hourly · daily

locks advisory

Analytics Reader

fast count

Pre-aggregated stats. Zero scan for known queries.

response <5ms

Pub/Sub Bus

fan-out

Channel-scoped. One subscriber connection per gateway.

topology channel-scoped

conn shared

Live Gateway

WebSocket

Bidirectional. Authenticated, sticky to project.

transport WS

auth token mint

Live Browser

streaming UI

Real-time feed. Filters, replay, vectorized memory search.

modes live · replay

search vector + text

Rule Matcher

evaluator

Compiles patterns once. Bloom-filter prefilter, regex fallback.

compile once

prefilter bloom

Dispatcher

channel router

Routes alerts to destinations. Per-rule cooldown, retry queue.

destinations webhook · chat

retry exponential

Notify Channels

webhook fan-out

Slack, Discord, Telegram, generic HMAC-signed webhooks.

signed HMAC-SHA256

idem per-event

Orchestrator

startup engine

Warms caches, validates schema, syncs revisions on boot.

warmup ~250ms

cron 5s tick

Cache Warmer

prefill loop

Hot keys, projection state, JWT revocation lists.

targets hot keys

cadence 5s

Metrics

telemetry

Per-task counters, GC stats, queue depths, p99 histograms.

shape prom

scrape 5s

Stop searching. --replay_

Your logs. Searchable, replayable, actionable. No dashboards. No noise.

--memory logs that survived retention — searchable forever FOREVER LOGS

--replay relive any incident at 1×/2×/10× speed REPLAY

--task open Jira / Linear / GitHub issue from a log ISSUE TRACKERS

--count count all the found logs even if not all are visible COUNT

--send push log context to Slack or Discord MESSAGING

--group group occurrences by default, no messy 1000 logs GROUPING

--separate::message remove json from message and separate to context GROUPING

--diff compare time windows for anomalies ANOMALY DETECTION

--timeline show interactive timeline chart TIMELINE

--alerts manage alerts without switcing any page CORE

--keys that goddamn api key? simple to get CORE

--account see your account settings CORE

--usage see your account usage CORE

--billing see your account billing details and update CORE

--live real-time log streaming LIVE

--rate logs-per-hour velocity chart ANALYTICS

--top top values for any field ANALYTICS

--export async Parquet / CSV export EXPORT

#saved saved filter views shared across team VIEWS

level:error @today human-readable filter syntax QUERY

trace: distributed trace filtering TRACING

--memory logs that survived retention — searchable forever FOREVER LOGS

--replay relive any incident at 1×/2×/10× speed REPLAY

--task open Jira / Linear / GitHub issue from a log ISSUE TRACKERS

--count count all the found logs even if not all are visible COUNT

--send push log context to Slack or Discord MESSAGING

--group group occurrences by default, no messy 1000 logs GROUPING

--separate::message remove json from message and separate to context GROUPING

--diff compare time windows for anomalies ANOMALY DETECTION

--timeline show interactive timeline chart TIMELINE

--alerts manage alerts without switcing any page CORE

--keys that goddamn api key? simple to get CORE

--account see your account settings CORE

--usage see your account usage CORE

--billing see your account billing details and update CORE

--live real-time log streaming LIVE

--rate logs-per-hour velocity chart ANALYTICS

--top top values for any field ANALYTICS

--export async Parquet / CSV export EXPORT

#saved saved filter views shared across team VIEWS

level:error @today human-readable filter syntax QUERY

trace: distributed trace filtering TRACING

features

built for the moment something breaks.

Every feature is reachable from the same filter bar. No tab-hopping. Type a command, get an answer, keep moving.

01 · human-readable queries

Not SQL. Not Lucene. Just how you think.

level:error from:yesterday message:"payment" — plain-language filters, typed the way you describe the problem out loud.

❯ level:error from:yesterday message:"payment" context.user_id:42

02 · query 50M in <500ms

Engine is fast. Filtering is a breeze.

Purpose-built columnar store, sharded on time and service. No sampling, no cold-tier games.

<500ms

50M log query

45k/s

ingest throughput

03 · patterns, not noise

1,000 errors → 25 signals.

Automatic grouping by shape. One row per pattern, with a count.

412stripe.charge timeout

287null address on order

103db pool exhausted

1,482 logs → 25 root causes

04 · live streaming

Debug without distraction.

--live:off freezes the stream. Flip it when you're done focusing.

live

14:32:08ERRPOST /checkout 500

14:32:09INFretry · attempt 2

14:32:10ERRstripe timeout

14:32:11INFheartbeat · billing-worker

05 · CLI everywhere

Type `--` anywhere.

Command palette, filter bar, log detail — same verbs, same syntax. 35+ of them.

--diffcompare time windows for anomalies

--top:endpointtop endpoints by error rate

--send:slackpush context to #ops

--save:my-viewsave the current filter

06 · --investigate

AI root-cause, with your codebase in context.

Run --investigate on any error. Loguro finds the exact file and line in your repo, determines the probable cause, grades severity, and writes a fix proposal — saved permanently to the log.

finds your code

Searches your codebase by symbol, file path, or message — pins the exact line responsible.

streams analysis

Probable cause, affected area, severity grade, suggested fix — markdown-formatted, re-runnable anytime.

attach a note

Use --note to pin business context directly to the investigation — "this happens every deploy friday" stays with the error forever.

07 · --task

One log → one ticket. Forever remembered.

File a Linear, Jira, or GitHub issue straight from the filter bar. The moment a task is created, the full log context is pinned permanently — no retention policy ever deletes it. Search it anytime with --memory.

linearENG-4821Checkout 500s after a82f109 — null address

github#1129Add null-guard in OrderService.FinalizeAsync

jiraOPS-312DB pool resize for checkout-rw · waiters=40

✦ log pinned · forever · searchable via --memory

surfaces

three ways in. one source of truth.

Web, terminal, or AI agent — every surface hits the same backend. Auth and project links are shared. Switch freely.

01 · web console

Click, drag, replay.

Visual exploration with charts, timelines, replay, and embed widgets. Best for setup, dashboards, and visual investigation.

logu.ro

❯ level:error @last-1h

Open the console →

02 · cli

Ship from the terminal.

Single npm package. One PAT covers all your projects. Pipe to jq, wire into CI, query 50M logs without leaving the shell.

$ loguro init

→ auth · project · key · link · first log

$ loguro logs -l error --from 1h | jq

Read the CLI docs →

03 · mcp

Talk to your logs.

Claude, Cursor, or any MCP-aware editor. Ask in natural language, get answers grounded in your real logs — no context switch.

you

what errors hit /checkout last hour?

calling query_logs…

→ 23 errors, 18× stripe.timeout, all from billing-worker

Set up MCP →

One ~/.config/loguro/auth.json. Run loguro login once — every surface picks it up.

how it works

Zero to insight. Under 60 seconds.

Send.

Any language. One endpoint.

HTTP POST. JSON body. Node, Python, PHP, Go, Rust, curl — anything with a network stack. Your first log live in under 60 seconds.

POST /ingest

curl -X POST https://ingest.logu.ro \
  -H "Authorization: Bearer lgu_••••" \
  -d '{"level":"error","message":"DB timeout"}'
← 201 · ingested · live

Find.

Type how you think.

Plain language, deep context, 50M logs under 500ms. Pattern grouping collapses 1,000 logs into 25 signals automatically.

❯ level:error @today context.user_id:42 |

412stripe.charge timeout

287null address on order

103db pool exhausted

Act.

Right here. Never leave.

Create a Jira ticket and notify Slack in one command without leaving the log. Loguro vectorizes the error and watches for it — even after the log expires.

❯ --task:linear --send:slack#ops

✓ENG-4821 created in Linear

✓posted to #ops · 3 teammates notified

✦error vectorized · watching permanently

commands

one bar. every command.

Filter bar, ⌘K palette, log detail — same syntax everywhere. Type -- and the command is already there.

--investigate

root-cause analysis with file + line from your codebase

MEMORY

--memory

search logs that survived retention, forever

REPLAY

--replay

relive any incident at 1×, 2×, or 10× speed

ANALYTICS

--rate

logs-per-hour velocity chart

ANALYTICS

--top

top values for any field, ranked by count

ANALYTICS

--diff

compare two time windows for anomalies

ANALYTICS

--timeline

interactive timeline chart over results

LIVE

--live

real-time streaming — flip off to freeze

ISSUES

--task

open Jira, Linear, or GitHub issue from a log

MESSAGING

--send

push log context to Slack or Discord

GROUPING

--group

collapse 1,000 occurrences into 25 patterns

GROUPING

--separate::message

split JSON out of message into context fields

ALERTS

--alerts

manage alert rules without leaving the log view

EXPORT

--export

async Parquet or CSV export of any result set

CORE

--count

count all matched logs even when list is capped

CORE

--keys

create and rotate API keys instantly

STATUS

--embed::status

generate a live status page widget from heartbeats

VIEWS

#saved

saved filter views shared across the team

See all commands

pricing

Pay per log. Nothing else.

We count logs, not gigabytes. No indexing overhead, no compression fees. Quota resets every month.

Free

€0 /mo

For side projects and exploration

→ 1 active alert
→ Real-time alerting
→ Human-First Syntax
→ Embed widget (view only)
→ 1M logs/mo
→ 7 days log retention
→ discord notifications

Solo

€19 /mo

For solopreneurs and indie devs

→ Everything in Free +
→ 5 active alerts
→ CSV export
→ Replay (up to 4x)
→ Embed widget
→ Project groups
→ Slack notifications
→ 50 AI investigations/mo
→ 15M logs/mo
→ 14 days log retention
→ discord & webhook & slack notifications

stop grepping. start asking.

Your logs, searchable in plain English. Your errors, investigated in seconds. Your incidents, replayable forever. No setup ritual.

get started free read the docs

Stop searching. --replay_

built for the moment something breaks.

Not SQL. Not Lucene. Just how you think.

Engine is fast. Filtering is a breeze.

1,000 errors → 25 signals.

Debug without distraction.

Type -- anywhere.

AI root-cause, with your codebase in context.

One log → one ticket. Forever remembered.

three ways in. one source of truth.

Click, drag, replay.

Ship from the terminal.

Talk to your logs.

Zero to insight. Under 60 seconds.

Send.

Find.

Act.

one bar. every command.

Pay per log. Nothing else.

stop grepping. start asking.

Type `--` anywhere.