LogSleuth

When something breaks across more than one system, the story is usually spread across four log files in four formats that disagree about what time it is. LogSleuth loads them all, detects each format, and stitches the entries into one chronological timeline you can filter and search. Click an error in one log and the others light up around the same moment, so you can follow the cascade instead of alt-tabbing between tabs.

What it does

• Opens individual files or recursively scans directories for logs.
• Detects common formats through built-in profiles.
• Lets you add custom TOML format profiles.
• Merges multiple files into one chronological timeline.
• Filters by severity, text, regex, source, and time range.
• Tails active logs live.
• Watches directories for new or changed logs.
• Adds bookmarks to important entries.
• Persists sessions so investigations can be resumed.
• Exports filtered results.

Requirements

• Windows, macOS, or Linux.
• Read access to the logs you want to inspect.
• Rust only if building from source.

Windows builds can also parse .evtx event log files where supported.

Install

Download the latest release from:

https://github.com/Swatto86/LogSleuth/releases

Run the executable and open a file or directory.

First use

1. Open LogSleuth.
2. Choose a log file or a directory containing logs.
3. Let LogSleuth detect formats and build the merged timeline.
4. Filter by severity, text, regex, or time range.
5. Bookmark important entries.
6. Export the filtered set if needed.

Core concepts

Format profiles

Profiles tell LogSleuth how to parse timestamps, severity, message text, and optional source fields. Built-in profiles cover common formats. Custom profiles are TOML files, so you can adapt LogSleuth to application-specific logs.

Merged timeline

When multiple files are loaded, entries are normalized and sorted by timestamp. This makes it easier to correlate a front-end error, API error, service restart, and database warning in one view.

Live tail

Live tail follows files as new lines are written. Use it while reproducing a problem or watching a service restart.

Directory watch

Directory watch tracks new or changed log files in a folder. It is useful for applications that rotate logs or create one file per process/session.

Bookmarks

Bookmarks mark entries you want to return to during an investigation. Use them for root-cause candidates, first error, last healthy event, or handover notes.

Filtering

Useful filtering patterns:

• set a time window first when you know when the incident happened
• filter to Error and Warning before searching broad text
• use regex when logs have structured IDs, request IDs, or correlation IDs
• copy filtered results before handing evidence to another person

Export

Export filtered results to CSV for spreadsheet review or JSON for structured analysis. Export the narrowed result set rather than every loaded entry.

Custom profiles

Use custom TOML profiles when LogSleuth does not recognize your log format. A profile defines how to parse fields such as timestamp, level, and message.

The README also documents a profile-generation workflow from a log directory. Use that as a starting point, then review the generated profile against real samples.

Build from source

git clone https://github.com/Swatto86/LogSleuth.git
cd logsleuth
cargo build --release
cargo run

Run with debug logging:

RUST_LOG=debug cargo run

Troubleshooting

Timestamps are not parsed

Check whether the file matches a built-in profile. If not, create or adjust a TOML profile for that format.

Timeline ordering looks wrong

Confirm that all files use comparable time zones or timestamp formats. Mixed local time and UTC can make correlation misleading.

Live tail does not update

Make sure the file is still being appended to and that the app has read permission. For rotated logs, use directory watch as well as live tail.

Links

• GitHub: https://github.com/Swatto86/LogSleuth
• Releases: https://github.com/Swatto86/LogSleuth/releases