FORMATS & RECIPES / START WITH WHAT YOU HAVE

Your logs.
First answer.

Lantern recognizes common formats, normalizes timestamps and levels, and lets you query messages and parsed fields in the same terminal workflow.

Python 3.9+truecolor terminal114 × 39 recommended
01 / RECOGNIZE THE LINE

Bring the logs you already have.

Open a file, send a stream over standard input, or start with the included deterministic sample. Format detection happens as Lantern reads.

APPLICATION EVENTS

JSON Lines

{"ts":"2024-01-15T13:55:36Z","level":"error","msg":"failed","status":500}

ts · level · msg · status

SERVICE LOGS

logfmt

time=2024-01-15T13:55:36Z level=info msg="GET /x" status=200

time · level · msg · status

ACCESS LOGS

nginx / Apache

127.0.0.1 - - [10/Oct/2000:13:55:36 -0700] "GET /x HTTP/1.0" 200 2326

host · request · status · bytes

SECURITY EVENTS

CEF

CEF:0|Security|threatmanager|1.0|100|worm stopped|10|src=10.0.0.1

vendor · product · severity · src

SYSTEM LOGS

syslog

<34>Oct 11 22:14:15 host su[1234]: failed login

priority · host · process · message

ANYTHING ELSE

plain text

2024-01-15 13:55:36 ERROR disk full

timestamp · level · message

OPEN A FILElantern-ant /var/log/app.log
FOLLOW KUBERNETESkubectl logs -f my-pod | lantern-ant
TRY THE SAMPLElantern-ant samples/app.jsonl
02 / ASK A QUESTION

Queries read like an investigation note.

Press /, enter a query, then press Enter. Space-separated clauses are joined with AND.

01NUMERIC FILTER

Find server errors

status>=500

Find events whose parsed status is 500 or higher.

02COMBINED CLAUSES

Trace an auth rejection

status>=400 source=auth-service declined

Clauses are ANDed, so every result matches the status, source, and message term.

03REGEX + EXCLUSION

Inspect an API path

endpoint~^/v1/ -healthz

Match the versioned API path while excluding health checks.

04FIELD PRESENCE

Follow correlated failures

has:trace_id level=error

Require a trace identifier and an error-level event.

05MISSING FIELD

Find incomplete timeouts

missing:status timeout

Find timeout messages whose parsed event has no status field.

QUERY SHORTHAND

A small language for the trail.

field=value
Exact or substring match.
field>=400
Numeric comparison.
field~regex
Case-insensitive regex match.
has:field
Require a field to be present.
-word
Exclude a message, source, or level term.
KEEP GOING

Start with a real event.

Use the Quickstart for the first five minutes, or go to the repository for the complete query grammar and format reference.

Open Quickstart Read the Usage Guide →Read the User Manual →