Best Log Viewers for the Terminal
Compare lnav, logss and stern for reading, tailing, searching and filtering logs in a terminal, from local files to Kubernetes pods.
Updated
short verdict
Pick lnav as the default for local log files: it detects formats, merges sources by time, and adds SQL queries. Pick stern if your logs live in Kubernetes pods, and logss if you pipe one live stream and want it split by regex into separate panes.
Viewing logs in a terminal covers three different jobs: browsing files after the fact, following a live stream, and collecting output from many sources at once. lnav is a full log file browser with indexing and SQL. logss splits a single stream into regex-defined containers. stern tails many Kubernetes pods at the same time. They overlap less than the job title suggests, so the right pick depends on where your logs come from.
this page is for
- Developers reading and correlating local or rotated log files
- Operators following logs across many Kubernetes pods
- Anyone watching one live stream for several patterns at once
Best default for log files: it detects formats, merges files chronologically, and lets you query them with SQLite.
best for
- Correlating events across several log files
- Reading compressed or rotated logs without decompressing
- Reading journald output piped from journalctl
strengths
- Merges multiple sources into one chronological view and detects formats automatically, including JSON lines
- Jump between errors with e/E, search by regex with /, and view a message histogram with i
- Runs SQLite queries on logs with ; and filters messages by regex or SQLite expression
- Reads compressed files directly, follows renames, and watches directories for new files
weaknesses
- Has no Kubernetes pod discovery; you need to feed it input from elsewhere
- Its many hotkeys and its SQL prompt take longer to learn than a plain tail
Best for Kubernetes: it tails every pod matching a regex and follows pods as they are created or deleted.
best for
- Following a deployment, daemonset or statefulset across all its pods
- Teams that already use kubectl contexts and namespaces
strengths
- Matches pod names by regex and accepts resource/name queries such as deployments
- Filters by container pattern, label selector or field selector, and can exclude lines or highlight patterns
- Outputs JSON or custom Go templates for scripting
- Color-codes output per pod and container, and installs as a kubectl Krew plugin
weaknesses
- Only reads Kubernetes logs; it cannot open local files
- Prints a stream to the terminal with no interactive browsing, indexing or SQL
Best for watching one live stream split into color-coded panes by regex, with optional shell triggers on matches.
best for
- Watching several patterns in one application or web server log at once
- Piping a command's output and exporting matched lines
strengths
- Reads stdin or runs a command directly, and defines containers with -c pattern or a config file
- Vertical and horizontal layouts, with pause, scroll, zoom and line wrap toggle
- Containers can run shell commands on a match, with timeout controls
- Exports matched lines to separate files and shows a bar chart popup of match counts
weaknesses
- Works on a live stream; it has no format detection, file merging or SQL analysis
- Smaller feature set for history search than lnav
How to choose
- Log source: local files and rotated archives go to lnav; Kubernetes pods go to stern.
- Multi-source correlation: lnav merges files chronologically; stern merges pods but has no time-based browsing.
- Querying: lnav wins with embedded SQLite via ;, plus regex or SQLite filter expressions.
- Live pattern monitoring: logss wins by splitting a stream into regex containers and running triggers on matches.
- Scripting output: stern wins with JSON output and custom Go templates.
When not to use these
- You need long-term centralized storage and search across hosts; these tools only view logs from the terminal.
- A single grep or tail on one file already answers your question.
FAQ
- Which tool is best for reading log files in the terminal?
- lnav. It detects log formats, reads compressed files, merges multiple files by time, and supports regex search with / and SQLite queries with ;.
- How do I tail logs from many Kubernetes pods at once?
- Use stern. It matches pod names by regex, follows new and deleted pods automatically, and accepts queries like deployment/name plus label and field selectors.
- Can I use lnav with systemd journal logs?
- Yes. Pipe journalctl into lnav. It supports standard and JSON output, and with JSON it recognizes fields such as PRIORITY and _SYSTEMD_UNIT.
- Can I split one log stream into several views by pattern?
- Yes, with logss. Define patterns with -c pattern or a config file, and each match goes to its own color-coded container.