Skip to main content
Zeal lets you query log files with a SQL-like language. It ships as a single static binary with no dependencies, auto-detects your log format, and gives you temporal correlation that no other tool offers. 
# Find all errors instantly
zeal 'FROM /var/log/app.json WHERE level = "error"'

# The killer feature: find errors within 5s of a warning
zeal 'FROM /var/log/app.json WHERE level = "error" WITHIN 5s OF level = "warn"'

Installation

Get the single static binary running on Linux or macOS in under a minute.

Quick start

Write your first query and filter logs in seconds.

​
Why Zeal?

Existing tools each solve part of the problem, but none covers all of it:
  • grep matches text but can’t filter by field values, compare numbers, or correlate events across time.
  • jq is powerful for JSON but can’t handle logfmt or plain text, and has no temporal logic.
  • zeal gives you a single consistent query language across all log formats — plus temporal correlation that neither tool can do.
Capabilitygrepjqzeal
Filter by field value—JSON onlyJSON, logfmt, plain text
Numeric comparisons (>= 500)—JSON onlyAll formats
Substring searchWith regexWith test()CONTAINS (case-insensitive)
logfmt supportText only—Native
Plain text supportNative—Native
Temporal correlation——WITHIN 5s OF
Aggregate / group—With reduceGROUP BY
Follow mode——--follow

​
Core concepts

​
Query language

Zeal uses a SQL-inspired syntax with four clauses: 
FROM <source>, ...
[WHERE <expression>]
[GROUP BY <field>, ...]
[SHOW FIRST|LAST <n> | SHOW COUNT]
You write queries as a single quoted string. The FROM clause names the log file (or files). WHERE filters entries using operators like =, >=, CONTAINS, and boolean logic.

​
Temporal correlation

The standout feature. The WITHIN ... OF clause lets you find log entries that occurred near other entries in time: 
# Errors that appeared within 5 seconds of a warning
zeal 'FROM app.json WHERE level = "error" WITHIN 5s OF level = "warn"'
Zeal uses binary search on sorted timestamps, giving O(n log m) performance. Duration units are ms, s, m, h, and d.

​
Auto-detection

Zeal reads the first line of each file to detect the format — no flags required:
FormatDetection ruleExample
JSONFirst line starts with {{"level":"error","msg":"timeout"}
logfmtFirst line contains key=value pairslevel=error msg="timeout"
Plain textEverything else2024-01-15 10:30:06 ERROR timeout
Common field aliases (level/lvl/severity/log_level, message/msg/text/body, timestamp/ts/time/t/@timestamp/datetime/date) are mapped automatically across formats.

Build docs developers (and LLMs) love

Get started for freeTalk to us