GoAccess — Real-Time Web Log Analyzer for Terminal and Browser

Introduction

GoAccess is an open-source real-time web log analyzer that runs in the terminal or generates standalone HTML reports. It parses access logs from Nginx, Apache, Amazon S3, CloudFront, and other web servers to give immediate visibility into traffic patterns without shipping data to external services.

What GoAccess Does

• Parses web server logs in real time with sub-second refresh in the terminal
• Generates self-contained HTML dashboards with WebSocket live updates
• Supports combined, common, and custom log formats out of the box
• Tracks visitors, requests, referrers, status codes, and geolocation
• Processes piped input for streaming analysis of growing log files

Architecture Overview

GoAccess is written in C and designed for minimal resource usage. It reads log lines sequentially, parses them against a configurable format string, and stores aggregated metrics in an in-memory hash table backed by optional on-disk persistence via Tokyo Cabinet or Berkeley DB. The HTML output embeds a small JavaScript client that connects over WebSocket to the GoAccess daemon for live updates.

Self-Hosting & Configuration

• Install via system package managers or compile from source with optional GeoIP support
• Configure the log format in ~/.goaccessrc or pass --log-format at runtime
• Run as a daemon with --real-time-html to serve a live-updating dashboard
• Enable GeoIP lookups by pointing to a MaxMind database file
• Use --persist and --restore flags for on-disk storage across restarts

Key Features

• Handles logs with millions of entries using minimal memory
• Terminal (ncurses) and browser (HTML/WebSocket) output modes
• Incremental log processing for efficient repeated analysis
• Built-in support for virtual hosts and time-distribution panels
• No JavaScript frameworks or external dependencies in the HTML report

Comparison with Similar Tools

• AWStats — generates static HTML reports on a schedule; GoAccess offers real-time streaming
• Matomo — JavaScript-based analytics requiring a database; GoAccess works directly from log files
• Plausible — SaaS-oriented privacy analytics; GoAccess is fully self-hosted and offline
• Elastic Stack — full observability platform; GoAccess is a single binary with zero dependencies
• Nginx Amplify — Nginx-specific SaaS monitoring; GoAccess supports any web server log format

FAQ

Q: Can GoAccess handle multiple log files? A: Yes. Pass multiple files as arguments or pipe them together; GoAccess merges the data seamlessly.

Q: Does it support JSON or CSV output? A: Yes. Use --output-format=json or --output-format=csv for programmatic consumption.

Q: How do I use GoAccess with Docker? A: Mount your log files into the official container image and expose the WebSocket port for live HTML dashboards.

Q: Is GeoIP data included? A: No. You need to supply a MaxMind GeoLite2 database file separately and point GoAccess to it via configuration.

Sources

• https://github.com/allinurl/goaccess
• https://goaccess.io