angle-grinder

angle-grinder (binary name agrind) is a command-line tool for parsing and aggregating log files. It fills the gap when your logs are not in a system like Graphite, Honeycomb, Kibana, Sumo Logic, or Splunk but you still need analytics such as counts, sums, averages, min/max, percentiles, and sorting. Results update live in the terminal as input is processed. The README states it can process well above 1M rows per second, with simple pipelines reaching 5M.

Queries are a filter followed by a pipeline of operators: agrind '<filter> | operator1 | operator2 | ...'. Filters match lines using case-insensitive wildcards, case-sensitive quoted strings, and AND, OR, NOT. Parsing operators include json, logfmt, split, pattern-based parse, and parse regex using Rust regex syntax with named captures. Other operators include fields, where, limit, and field expressions (<expr> as <name>) with arithmetic and boolean operators. Aggregators include count, sum, min, max, percentile, sort, total, and count distinct. For example, agrind '* | json | count by log_level' counts JSON log lines per level.

Since v0.12.0, experimental aliases let you save pipelines in TOML files in a .agrind-aliases directory. These files are searched in the current directory and its parents. A query can then call them by keyword, for example * | apache | count by status. Since v0.9.0, agrind can update itself with --self-update. Binaries are provided for Linux and macOS, and other platforms, including Windows, can be built from source. It is aimed at developers and operators who analyze log files from the shell.

Installation

# via Homebrew
brew install angle-grinder

# via Cargo
cargo install ag

# via Binary download (Linux MUSL)
curl -L https://github.com/rcoh/angle-grinder/releases/download/v0.18.0/agrind-x86_64-unknown-linux-musl.tar.gz \
  | tar Ozxf - \
  | sudo tee /usr/local/bin/agrind > /dev/null && sudo chmod +x /usr/local/bin/agrind