Zeal can read from multiple log files in a single query. This lets you correlate events across services — for example, matching app errors against nginx access logs — without running separate commands and manually comparing output.
Two ways to specify multiple sources
Comma-separated in the FROM clause:
zeal 'FROM /var/log/app.json, /var/log/nginx.log WHERE status >= 500'
-f flags:
zeal -f app.log -f nginx.log 'WHERE status >= 500'
-f flags when building commands programmatically or when file paths come from variables.
Correlate app errors with nginx 5xx responses
A common use case: an error appears in your application logs, but you want to know whether nginx also reported a 5xx for the same request window.
zeal 'FROM /var/log/app.json, /var/log/nginx/error.log WHERE status >= 500'
source field indicating which file the entry came from.
Compare error rates across services
To compare error volume between services, run a separate count query for each:
zeal 'FROM /var/log/api.json WHERE level = "error" SHOW COUNT'
zeal 'FROM /var/log/worker.json WHERE level = "error" SHOW COUNT'
API_ERRORS=$(zeal --format raw 'FROM /var/log/api.json WHERE level = "error" SHOW COUNT')
WORKER_ERRORS=$(zeal --format raw 'FROM /var/log/worker.json WHERE level = "error" SHOW COUNT')
echo "api: $API_ERRORS worker: $WORKER_ERRORS"
Each file is parsed with its own format auto-detection. You can mix JSON and logfmt sources in the same query — Zeal detects the format from the first line of each file independently.
# app.json is JSON, nginx.log is plain text — both work
zeal 'FROM /var/log/app.json, /var/log/nginx.log WHERE message CONTAINS "timeout"'
