ngtop

ngtop is a Go-based CLI utility for analyzing nginx access logs. It parses log entries into an SQLite database and allows users to run filtered queries for request statistics. ### Installation Download the pre-built binary from releases or install via Go: `go install github.com/facundoolano/ngtop@latest`. ### How It Works On each run, ngtop discovers nginx access logs (defaulting to `/var/log/nginx/access.log*`), parses them using the combined log format, and stores parsed entries in an SQLite database (`./ngtop.db` by default). Subsequent runs only process new log entries not yet stored. ### Query Capabilities The tool supports filtering and aggregation across multiple dimensions: - **Paths**: Top requested URLs, with pattern matching (`/blog/%`) - **User agents**: Group by browser, OS, device, or bot detection - **IPs**: Top requesting IPs, or top URLs per IP - **Referers**: Top referrers for specific URL patterns - **Status codes**: Count responses by HTTP status, including pattern matching (e.g., `4%`, `5%`) - **Time ranges**: Limit queries to the last second, minute, hour, day, week, or month with `--since`/`-s`, and optionally `--until`/`-u` for a window - **Filters**: Combine multiple conditions with `--where`/`-w` using operators like `=`, `!=`, and `LIKE` ### Configuration Behavior is controlled via environment variables: - `NGTOP_LOGS_PATH`: Glob pattern for log file locations - `NGTOP_LOG_FORMAT`: Custom nginx log format string - `NGTOP_DB`: Path to the SQLite database - `NGTOP_DEBUG`: Enable internal logging This makes ngtop a lightweight, low-overhead analytics layer for nginx deployments where full-stack log aggregation isn't practical.