Logchef 2.0VictoriaLogs is here

Open-source log analyticsfor ClickHouse & VictoriaLogs

Search, tail, visualize, and alert on logs without adding another log storage layer. Logchef runs as a single self-hosted binary and queries the data already in your infrastructure.

Explore the demoSelf-host LogchefLogchef GitHub stars
DeploySingle binary
Data modelNo new storage layer
BackendsClickHouse + VictoriaLogs
InterfacesWeb · CLI · MCP
AccessRBAC included
Log Explorerdemo.logchef.app
The Logchef log explorer showing a query, a histogram of matching events, and a table of structured log rows
New in Logchef 2.0

One operational view across every log backend

VictoriaLogs is now a first-class datasource, and dashboards can combine it with ClickHouse on the same grid. The backend changes; the investigation workflow does not.

DashboardsClickHouse + VictoriaLogs
A Logchef operational dashboard combining ClickHouse and VictoriaLogs panels
Cross-source dashboards

See the whole system, not another silo

Mix ClickHouse and VictoriaLogs panels on one grid. Stats, time series, breakdowns, and tables share the same time range and refresh together.

Log ExplorerNative LogsQL
Logchef running a native LogsQL query against VictoriaLogs
VictoriaLogs, first-class

Use LogchefQL, or go native

Explore VictoriaLogs with the same field-first workflow as ClickHouse, then switch to native LogsQL whenever an investigation needs backend-specific power.

LogchefQL

One workflow. Native when you need it.

lvl="ERROR" and duration_ms>500

Use LogchefQL across every source, or switch to native SQL and LogsQL without leaving the investigation.

ClickHouse

Native SQL when you need it.

TABLE default.app_logs · MergeTree
Compiled from LogchefQL
SELECT * FROM default.app_logs
WHERE (lvl = 'ERROR')
  AND (duration_ms > 500)
Matching event
14:03:17.512 ERROR edge-gateway ap-south 812ms upstream timeout on /v1/checkout
VictoriaLogs

Native LogsQL when you need it.

SOURCE waf-security · HTTP API
Compiled from LogchefQL
(lvl:="ERROR") AND (duration_ms:>500)
Matching event
_time=14:03:17.512 lvl=ERROR service_name=edge-gateway region=ap-south duration_ms=812

Your backend stays the source of truth. Logchef queries ClickHouse and VictoriaLogs directly. There is no re-ingestion, duplicate storage, or schema migration.

The daily workflow

Everything between storage and answers

Your backend already stores the logs. Logchef gives your team one place to explore them, understand their structure, reuse useful queries, and act when something breaks.

Log ExplorerCompact view
Logchef showing a condensed log view with a histogram above the result rows
Explore

Scan fast, then narrow

Compact rows put more events on screen. The histogram above them shows when the spike happened, so you can watch your query close in on it.

FieldsTop values
The Logchef field sidebar listing fields with their top values and counts
Fields

Discover the shape of your data

Inspect available fields, top values, and counts without leaving the results. Click any value to add a filter instead of memorizing column names.

AlertsEmail · Webhook
The Logchef alert rule editor with a query, schedule, and notification targets
Alerts

Turn a useful query into an alert

Save a query as a rule and pick how often it runs. When it matches, Logchef sends email or hits a webhook. The query that found the problem is the one that warns you next time.

AI AssistantGenerate · Validate
The Logchef AI assistant turning a plain-English request into a generated query
AI Assistant

Describe the question. Keep control of the query.

Describe what you're after. You get LogchefQL, ClickHouse SQL, or LogsQL back in the query bar, where you can read it and change it before it runs.

Agent-native by design

Give your coding agent a real log interface

The browser is only one way into Logchef. Use a schema-aware AI assistant, an agent-ready CLI, or an MCP server built for log investigations. Scoped tokens control access to the same ClickHouse and VictoriaLogs sources your team investigates.

logchef CLISpot the spike, then pull the evidence
A terminal session where the logchef CLI draws an error histogram with a visible incident spike, then fetches the matching payment error logs

MCP for log investigations

Connect Claude, Codex, Cursor, Copilot, or any MCP client. Agents can discover schemas, query logs, compare time windows, inspect alerts, and follow guided investigation prompts.

Annotated tools · scoped service tokens

Agent-ready CLI

Compose fields, explain, histogram, find, and live-tail commands in an investigation. Stable JSON and JSONL output keeps piped workflows clean and machine-readable.

--output jsonl --quiet

Version-matched agent skill

The CLI ships its query grammar, investigation loops, output contracts, and safety guidance. Your agent gets instructions guaranteed to match the binary you installed.

logchef skills get core --full

Schema-aware AI assistant

Ask in plain English and get LogchefQL, ClickHouse SQL, or LogsQL for the active source. Logchef validates the result and leaves it in the editor for review before it runs.

LogchefQL · SQL · LogsQL
New in v2.0

The largest Logchef release yet

VictoriaLogs, cross-source dashboards, live tail, local authentication, a more capable CLI, and production guardrails turn Logchef into a complete operational workspace.

VictoriaLogs, first-class

Search it with LogchefQL, or drop into LogsQL when you need to. Tenant headers and source scopes carry through every query. Alerts and live tail work the same as they do on ClickHouse.

Cross-source dashboards

Put ClickHouse and VictoriaLogs panels on the same grid. Drag and resize them in place. Time series, stats, breakdowns, and tables all share one time range.

Live investigation

Keep the filter that found the issue running and watch matching events arrive in the browser or your terminal.

RBAC included in open source

Use local login or OIDC, then control access with global, team, and collection roles. Source assignments isolate log data, scoped service tokens secure automation, and provisioning keeps access reproducible.

Investigate from the terminal

Query either backend from your terminal. Read the generated query before it runs, draw histograms, tail live, dig through fields and history, and hand any result off to the browser.

Guardrails for production

Cache dashboard results, set per-source ClickHouse query limits, stream large ClickHouse previews, and enable rate limits for shared deployments.

Deployment

One binary. Up in minutes.

Logchef itself has no runtime dependencies. Start with the bundled local demo stack, or download the binary and configure it for the ClickHouse or VictoriaLogs backend you already run.

# Start the bundled Logchef + ClickHouse demo stack
curl -LO https://raw.githubusercontent.com/mr-karan/logchef/main/deployment/docker/docker-compose.yml

docker compose up -d

# Open http://localhost:8125
Fits your existing stack

Keep your pipeline. Add the workspace.

Vector and OpenTelemetry keep shipping logs to the backends you already operate. Logchef connects to ClickHouse and VictoriaLogs as the query and control plane.

Ingestion

Your existing pipeline

Collect and route logs with the tools you already run.

VectorOpenTelemetry
Query + control plane

Logchef

Search, tail, visualize, alert, and automate across both backends.

Single binary

No forwarding changes. No duplicate storage. No schema migration.

Open source · Self-hosted

Your logs are already there. Put Logchef in front of them.

Start with the live demo, or deploy the single binary and connect your first ClickHouse or VictoriaLogs source.

Explore the demoSelf-host Logchef