VictoriaLogs is now a first-class datasource, right alongside ClickHouse. Add a VictoriaLogs source and explore it in the same place, with the same queries, dashboards, and access control you already use for your ClickHouse logs. This release also adds email-and-password login, easier dashboard editing, your own query history, and a round of speed and reliability work.
- VictoriaLogs datasource: Connect a VictoriaLogs instance and query it with LogchefQL or native LogsQL, then use it across the explorer, dashboards, alerts, and live tail. AI query generation, log context, and streamed exports are still ClickHouse-only for now. VictoriaLogs guide →
- Email & password login: Run Logchef with local accounts, alongside your SSO provider or without one at all. Learn more →
- Automatic SSO sign-up: If your administrator turns it on, a first sign-in from an approved email domain creates the account automatically instead of failing. Learn more →
- Live tail: Flip on Live in the explorer to watch matching log lines stream in as they arrive, on either datasource.
- Easier dashboard editing: Drag panels to move and resize them right on the dashboard, and edit each panel in a larger builder with a live preview.
- Dashboard chart styles: Show time-series panels as bars, lines, or areas, chosen per panel.
- Faster dashboards: Dashboards briefly reuse recent panel results, so a page full of panels loads quickly instead of re-running every query for every viewer.
- Query history: Reopen your recent queries from the explorer or with
logchef history in the CLI. Admins also get a Query Activity view with recent queries and overall usage by source and user. - Per-source query limits: If you run Logchef, you can cap what each ClickHouse source may spend on a single query, so one heavy query can't hog a shared cluster.
- Quick column filters: Filter the rows already on screen from any column header, by text match or number comparison, without running another query.
- Credentials stay private: Logchef no longer returns a source's saved password in its API, and you can update a source without re-typing it.
- Cleaner histogram charts: gaps in sparse or grouped data now show as zero instead of leaving holes, so charts read cleanly in the explorer and on dashboards.
- Correct times for every viewer: dashboard panels show timestamps in each viewer's own timezone.
- Optional request limits: if you run Logchef, you can rate-limit login and query traffic to protect a busy instance.
- Safer reverse-proxy setup: if you run Logchef behind a reverse proxy, it identifies the real client address without trusting forwarding headers that could be spoofed.
- Deleting a user deletes their sessions too: a removed user's session no longer keeps working until natural expiry.
- Condition-mode alerts aggregate over a real field:
sum/avg/min/max now use a field you pick, instead of a hardcoded column that didn't exist on most datasets. - ClickHouse query results no longer lose their columns on the alert-evaluation path, fixing alerts whose query returned rows failing to evaluate.
- Exports return a clean 400 (and the Download button hides) on sources that don't support them, instead of a 500 or a silently-failing background job.
The command-line tool catches up with the v2.0 server. It now queries VictoriaLogs sources the same way it queries ClickHouse, follows logs live in your terminal, and adds a handful of commands for exploring and debugging without leaving the shell.
- VictoriaLogs support: Query your VictoriaLogs sources from the terminal, just like ClickHouse ones.
- Live tail in the terminal:
logchef tail now follows matching logs as they arrive, on ClickHouse and VictoriaLogs. - Jump to the web explorer:
logchef open opens your current query in the browser, with the query and time range already filled in. - See the query first:
logchef explain prints the query Logchef would run, without running it. - Counts over time:
logchef histogram shows how often something happens across a time range. - Find your fields:
logchef fields lists a source's fields and their common values, so you know what to filter on. - Your recent queries:
logchef history reopens queries you ran earlier. - Check your setup:
logchef doctor diagnoses server, auth, and source problems when something isn't working. - Shell completions:
logchef completions for bash, zsh, and fish.
Logchef 1.7 makes the metadata store pluggable. Alongside the default single-binary SQLite, you can now run an opt-in Postgres backend so multiple Logchef replicas share state behind a load balancer. That's the groundwork for high availability. SQLite stays the default, so single-instance setups are unchanged. The release also lets you switch alerting off server-wide, opens collection curation to any participant, adds an admin "All Queries" browse view, and brings type-to-filter pickers and searchable, sortable tables to the member and resource pages.
- Opt-in Postgres metadata backend: Store users, teams, sources, saved queries, collections, alerts, tokens, and settings in Postgres instead of SQLite, so several Logchef replicas can serve any request off shared state. Set
database.driver = "postgres" with a [postgres] DSN (or the matching env vars). SQLite remains the default and the single-binary start is unchanged; your logs always stay in ClickHouse. Database backends & HA → - Turn alerting off server-wide: Set
alerts.enabled = false and the UI hides alerting entirely while every alert endpoint returns a clean 503. Useful when you run Logchef purely for exploration, or want a single alert-evaluating instance. - "All Queries" browse for admins: Global admins can now see every saved query, including ones not pinned to any collection. Queries on sources you can't reach show as locked.
- Redesigned Library: Saved queries and collections merge into a single
/logs/library (collections rail + detail pane). Collections gain an editor role, and editing a saved query is delegated to its creator, a global admin, or an owner/editor of a shared collection that contains it. The Save dialog gets an inline collection picker, and the UI only offers Edit/Delete actions you're actually allowed to take. - Curate shared collections as a member: Any participant (owner, editor, or member) can pin, move, and remove queries in a shared collection. Renaming, deleting, and managing members stays owner-only.
- Collection detail upgrades: Pin an existing saved query with an "Add query" search picker, move a query to another collection, and see each query's author in a new "Created by" column.
- Searchable pickers & tables: Type-to-filter dropdowns for inviting collection members and adding service accounts to teams, plus a search box and sortable columns on Manage Sources and team-member lists.
- Token expiry everywhere: The service-tokens admin page now shows the same expiry status as the profile API-token list (never expires / expires / expiring soon / expired), and the CLI flags an expired saved token in
logchef auth current.
- Pluggable store architecture: The metadata layer now sits behind a backend-agnostic contract with a shared conformance suite that runs against both SQLite and Postgres in CI, so the two backends stay in lockstep.
- Upgraded to Go 1.26 with hot-path optimizations across query handling.
- Collection member list is owner-only: now enforced on the server, not just hidden in the UI.
- Inline permission errors show a toast instead of bouncing you to a full-page Forbidden view. Toggles, saves, and deletes stay put on a 403.
- Dead toggles work again: several Switch/Checkbox controls (admin Active toggle, alert enable/disable, source TLS/auth, column selector, variable multi-selects) were silently no-op'd by a binding mismatch and now respond.
- Saved-query resolver no longer crashes on certain resolve paths; it returns a clean error instead.
- Accurate access errors for exports and shared queries:
404 only when something's missing, 403 when you lack team access. - Tighter memory accounting on large responses (fixes an under-count from the performance pass), cancellable field-value loading, and identifier validation on provisioned sources.
- UI polish: the add-query dialog no longer overflows, the Library "All queries" view survives navigation, and the date picker's type drift is fixed (TypeScript checks are green and enforced in CI again).
Patch release. Adds Service accounts: non-login principals you can add to teams and issue scoped API tokens for. Every token now carries an explicit scope list (e.g. logs:read, alerts:write) enforced by middleware, with presets and an active-preset highlight in the picker. The team member dialog distinguishes humans from service accounts, and service principals get a clear badge in team rosters. Also surfaces ClickHouse column comments through the schema API for the new Logchef CLI v0.1.6 to consume.
- Service accounts: Non-login principals managed at Administration → Service Tokens. Cannot authenticate via OIDC or CLI exchange; exist only to own tokens and team memberships. Learn more →
- Scoped API tokens: Tokens now carry an explicit list of scopes (
logs:read, alerts:write, …). Presets in the picker: Read-only, Logs viewer, Logs analyst, Alerts manager, Source admin, Full access. The active preset stays highlighted while the selection matches. - Account-type toggle in Add Team Member: Pick Human user or Service account; the dropdown filters to that type and shows the principal's name with email as a subtitle instead of the raw service-account email.
- Service account badge in team member tables: a bot icon and "Service account" pill so automation principals are visually distinct from humans.
- Manage teams on each service account card: team chips, a destructive warning when an account is in zero teams (its tokens won't reach any source), and an in-place add/remove dialog.
- Schema column descriptions: The schema API now surfaces ClickHouse column comments. Consumed by Logchef CLI v0.1.6's
schema command.
- "Create API Token" defaults to the Read-only preset. Previously defaulted to Full access, which made the scope picker look entirely disabled out of the box.
- Read-only preset is now every
:read scope. Adds tokens:read, users:read, settings:read. Admin-gated routes still enforce admin role separately. /admin/users/* routes 404 on service accounts. Service principals are managed via the dedicated /admin/service-accounts/* path so they can't be promoted through the human-user CRUD path.
- Scope picker checkboxes are interactive again. The component was bound to
:checked; the underlying primitive uses model-value. The bug was hidden behind the old Full-access default. - Token creation rejects empty scopes (HTTP 400). Requests with no scopes used to silently mint a full-access token.
- Corrupt or empty stored scopes fail closed. A token row with malformed scope JSON now grants no access instead of full access.
Major CLI release. Adds four new subcommands (saved-queries, find, tail, whoami, auth current), full time-range injection on raw SQL, agent-friendly output formats (msg, json-flat), a symmetric --explain / --dry-run split across query and sql, and TTY-aware highlighting so pipes don't need --no-highlight. Requires Logchef server v1.6.1+ for the saved-queries resolve endpoint and ClickHouse column descriptions.
saved-queries: List and run saved queries by name, numeric ID, or a pasted explorer URL. --var, --limit, --show-sql, and all output-format overrides supported.find <pattern>: Discover sources with recent matches for a service, job, host, or message pattern. Each match line is followed by per-column samples: label-shaped columns (service/host/job_name) get the top 3 values with counts; free-form text columns (msg) get one truncated sample row. Suppress with --no-samples. Per-source timeout defaults to 30s.tail <query>: Follow matching LogchefQL rows by polling. text, jsonl, or msg output; stable dedup across column-order changes; one-shot stderr warning when a poll returns at --limit.whoami: Print the authenticated user and accessible teams.auth current: Offline subcommand that prints the active context, server URL, and token source (config vs env), plus the token expiry when it came from saved config. No network call. Useful for "is my LOGCHEF_AUTH_TOKEN even set?" diagnostics.- SQL time flags on
sql: --since / --from / --to inject a timestamp predicate before the first top-level GROUP BY / ORDER BY / LIMIT / HAVING / SETTINGS / FORMAT. The scanner skips string literals, quoted identifiers, comments, and parenthesized subqueries; use __START__ / __END__ placeholders for full control (e.g. CTEs). --explain / --show-sql on query and sql: Print Generated SQL: <sql> to stderr, then continue executing. Plays cleanly with --output jsonl | jq pipes.--dry-run on query and sql: Print the resolved SQL to stdout (no prefix) and exit without keeping results. sql --dry-run is fully offline; query --dry-run calls the server once for LogchefQL translation.--output msg: Print only the message column (one row per line) on query, sql, collections, and saved-queries. Falls back to the first selected column when msg isn't projected.--output json-flat: Hoist JSON-shaped msg fields to top-level JSON rows on query, sql, collections, and saved-queries.LOGCHEF_DEFAULT_TEAM / LOGCHEF_DEFAULT_SOURCE: Env defaults when --team / --source are omitted. Precedence: flag → env → saved config.- Schema column descriptions:
schema --output text shows a new DESCRIPTION column when the source's ClickHouse columns carry comments; schema --output json includes them inline.
- Highlighting auto-disables on non-TTY output. All five subcommands (
query, sql, collections, saved-queries, tail) skip ANSI escapes when stdout is piped, so ... | jq and ... > file produce clean output without --no-highlight. The flag still works as an explicit override.
- CSV export & streaming SQL: New
--output csv and --stream flags on logchef sql. Stream large result sets directly without timing out, or pipe them to a CSV file. - v1.6.0 API compatibility: CLI now works with Logchef 1.6's de-teamed collections API. Saved queries resolve from your team membership automatically.
- Product name standardized: "LogChef" → "Logchef" throughout all CLI help text, prompts, and auth pages.
Logchef 1.6 reorganizes saved queries around Collections: cross-team curation lists you can share with teammates. Teams now exist purely for access control. A new Editor team role sits between Member and Admin: editors can save queries and manage collections without getting full admin rights.
- Collections: Group saved queries into shareable lists. Everyone gets a personal collection automatically. Shared collections are invite-only; queries you can't run show with a lock icon.
- Unified Saved Queries page: One place to browse, search, and pin queries. Pick "All Queries", your personal collection, or any shared collection from a dropdown at the top.
- "Add to Collection" drawer: Open the menu on any saved query and tick the collections you want it pinned to. Create new collections inline.
- Editor team role: A new role for teammates who curate queries and collections. Editors can save queries, create collections, and invite collection members. They can't invite team members or link sources; those stay admin-only.
- Share a saved query with a link:
/logs/saved/:queryId resolves the right team and source automatically, so the recipient lands directly on the query. - CSV / JSON downloads stream from the backend with admission control, so very large exports don't tip the server over.
- Calendar month/year drill-down in the date picker.
- OIDC
skip_email_verified_check: Skip the email-verified claim on providers that don't pass it through (e.g. Cloudflare Access in front of an upstream IdP). (#86) - Native ClickHouse TLS: Configure TLS directly in the source connection instead of relying on stunnel/sidecars. (#88)
- Save your own queries. The Save button is now visible to every team member (it was hidden from non-admins by mistake). Editing or deleting a saved query still requires the original creator or a global admin.
- Distinct icons for LogchefQL and SQL in the saved queries list, so you can tell them apart at a glance.
- Cleaner admin and settings pages: consistent header, sections, and empty-state styling across Users, Teams, Sources, System Settings, Profile, and Preferences.
- Saved queries belong to a source, not a team. Anyone with source access can see and run them. The team you saved from is just a hint used to pick the right access path.
- Explore UI polish: quieter top bar, concrete query placeholders, Local|UTC timezone toggle.
- Query Folders: replaced by Collections.
- Bookmarks: your starred queries automatically move to your personal collection.
- Very large query results are now capped (
[query] max_limit, default 100k rows) so the browser doesn't run out of memory. - Long raw SQL in the URL no longer trips the server's HTTP header size limit.
- Switching sources is race-free: the explorer waits for the new source's schema before running a query, and a slower in-flight response can't overwrite a faster one.
- Saved queries open against the right source: the query's source overrides any stale source param in the URL.
- Export job pruner is crash-safe: interrupted prunes no longer leave orphaned download files.
- Translate API errors are surfaced to the editor instead of failing silently.
- Export download URLs are relative, so downloads work behind reverse proxies that rewrite hostnames.
Contributors: @m0nikasingh: OIDC email verification skip (
#86), native ClickHouse TLS (
#88), AI SQL insert mode fix (
#89)
- Smart value autocomplete: Type
host= in LogchefQL and get instant value suggestions with occurrence counts from the field sidebar. Works inside quotes, auto-wraps strings, and escapes special characters. - Numeric field exploration: Fields like
status (UInt16) now auto-load their top values in the sidebar, just like LowCardinality fields.
- New visual theme: Upgraded to Tailwind CSS v4 with Vega/Zinc/Blue theme, sharper borders, and bolder chart colors
- Sidebar collapsed by default: More screen space for logs. Expand via rail hover or
Cmd+B - Theme toggle: One-click light/dark/system cycle in the sidebar footer
- Histogram redesign: New Unovis-based charts with brush-drag zoom and crosshair tooltips
- Lazy-loaded Monaco editor: SQL editor loads on demand for faster initial page load
- Hyphenated field names: Fields like
user-identifier now work correctly in all queries (was causing SQL subtraction errors) - Better error codes: Invalid field names and query parameters now return HTTP 400 instead of 500
- Histogram reliability: Fixed tooltip styling, null data crashes, 1-second bucket support, and brush zoom interaction
- Team admin permissions: Team admins can now manage members on provisioned teams
- Connection cleanup: Added idle timeout and periodic query tracker cleanup
- Canonical request logging & activity logs: Every API request emits a structured line with method, path, status, latency, user, and team. A companion activity log tracks user-visible state changes for audit.
- Product name standardized to "Logchef": Lingering "LogChef" casing replaced across the UI, docs, and log lines.
- Session-management logs dropped to DEBUG: Only
user.login stays at INFO; the rest was audit-grade noise. slog source field flattened to file:line: Easier to grep, fewer bytes per line.
- Team admins can manage members on provisioned teams. The managed flag was locking them out of all membership edits.
- Idle ClickHouse connection cleanup: Added
IdleTimeout and a periodic QueryTracker sweep so leaked connections don't accumulate. - Provisioning docs moved into the sidebar with a clearer "Getting started" sub-section.
- Declarative provisioning: Define teams, sources, and access control in a TOML config file for GitOps workflows. Supports dry-run mode, managed vs unmanaged resources, and a separate
provisioning.toml file. Learn more → - All Teams collections: Browse saved queries across all your teams from a single page with the new "All Teams" option in the team dropdown.
- Query cancellation: LogchefQL queries now properly cancel end-to-end (was a no-op)
- SQL mode integrity: Time/limit changes no longer silently rewrite raw SQL queries
- Histogram accuracy: Timestamp field detection limited to SELECT clause only
- Post-login redirect: Users return to their original page after OIDC login
- Calendar UX: Date picker highlights today with default times (00:00:00 / 23:59:59)
- No duplicate queries: Page load no longer fires the same query twice
- CLI team discovery: New
logchef teams command to list teams and IDs - CLI source discovery: New
logchef sources command to list sources for a team - CLI schema view: New
logchef schema command to show columns and types for a source
- CLI guidance: Missing team/source errors now suggest
logchef teams and logchef sources --team <team>
- Configurable query result limit: New
[query] max_limit config option (default: 1M rows). Export up to 1 million rows when your infrastructure supports it. - User preferences persistence: Your theme, timezone, display mode, and fields panel state now persist across sessions. No more re-setting preferences after every login.
- Team admins can manage their teams: Team admins now have access to team settings and member management without needing global admin privileges.
- Source editing and duplication: Edit existing source configurations and quickly duplicate sources for similar setups.
- SQL editor max height: Editor now caps at 300px with scrollbar for lengthy queries, leaving more room for results
- Histogram Group By: Histogram now auto-refreshes when changing the Group By column
- Dark mode date picker: Time icon now visible in dark mode
- Date picker improvements: Now button auto-applies and initial date format issues resolved
- JSON auto-parsing: JSON strings embedded in log fields now display as formatted objects
- Version sidebar matches the running binary: The
versionString linker flag is wired through to the UI, so the version badge no longer falls back to unknown. - Alertmanager UI settings removed: Obsolete after the SMTP / webhook alert delivery work in v1.2.0.
- TLS migration description corrected: The migration description for the alert-TLS toggle was misleading.
- Changelog template syntax escaped:
{{ ... }} examples now render literally instead of being interpolated.
--timeout on query: Override the server-side query timeout from the CLI.- Timezone auto-detection on
auth: logchef auth records your local IANA timezone in the saved context so subsequent queries use it by default. Config gained a version field for future schema migrations. - Pre-built binary install docs:
docs/integration/cli now lists download URLs for Linux x86_64/aarch64, macOS x86_64/aarch64, and Windows.
- LogchefQL prompt example: Interactive mode now shows
level="error" instead of the older unquoted form.
- Run saved queries from CLI: New
logchef collections command to list and execute your saved queries directly from the terminal. - Interactive CLI mode: Run
logchef query or logchef sql without arguments and get guided prompts to select your team, source, and enter your query. - Copy CLI command from web: Click the terminal icon in the explore toolbar to copy the equivalent CLI command for your current query.
- Explore history URL hydration: Browser back/forward now correctly restores the previous query and results.
- Logchef CLI: Query your logs from the terminal with syntax highlighting, multi-context support, and all the features of the web UI. Learn more →
- Multi-select variables: Select multiple values for a variable and they expand to
IN (...) clauses. Great for filtering by multiple hosts or services at once. - Optional SQL clauses: Wrap SQL clauses in
[[ ... ]] and they're automatically removed when the variable is empty. No more "WHERE 1=1" hacks. - Variable dropdowns: Configure variables as text inputs, dropdowns, or multi-selects with default values.
- Browse all saved queries: New "All Sources" view in Collections to see saved queries across your entire team.
- Direct email & webhook alerts: Send alert notifications via SMTP or webhooks without needing Alertmanager.
- No more database lock errors: Fixed intermittent "SQLITE_BUSY" errors that could occur during high traffic
- Time ranges now refresh before each query (relative times like "last 1 hour" update correctly)
- Collections load reliably on first visit
- Bookmark your favorite queries: Star saved queries for quick access. Bookmarked queries appear at the top of the collections dropdown.
- Shareable query links: Copy a direct link to any saved query to share with teammates.
- Better error messages: Query errors now show exactly where the problem is with helpful suggestions.
- Faster builds: Development builds are now 25x faster (2s vs 55s).
- Switching between saved queries now shows the correct content immediately
- Your team and source selection stays consistent when navigating between pages
- Field explorer sidebar: Browse all fields in your logs, see the most common values, and click to add filters. Just like Kibana's Discover.
- Cancel running queries: Press Escape or click Cancel to stop long-running queries. Actually cancels in ClickHouse, not just the UI.
- Auto-fit columns: Double-click a column header border to automatically fit the column to its content.
- Cleaner log table: Compact rows, click any cell to copy, and action buttons appear on hover.
- Alerting: Create alerts based on your log queries. Get notified via email, Slack, PagerDuty, or any webhook when conditions are met.
- Admin settings UI: Configure AI, authentication, and alert settings from the web interface instead of config files.
- Duplicate sources: Quickly create a new source by copying an existing one.
- Select specific columns: Use the pipe operator to show only the columns you care about:
status="500" | timestamp method path - Query nested JSON: Filter on deeply nested fields:
user.address.city = "NYC" - Query history: Quickly access your 10 most recent queries from the editor.
- Source details: View table schema, TTL settings, and sort keys for any source.
- Query variables: Use
{{variable}} in your queries and get input fields to fill in values. Great for reusable dashboards. - Prometheus metrics: Monitor Logchef performance with built-in metrics endpoint.
- Grafana dashboard: Pre-built dashboard for monitoring Logchef in production.
- Compact view: Terminal-style log display for viewing more logs at once.
- AI assistant integration: Connect Claude or other AI assistants to query your logs using Model Context Protocol (MCP).
- AI SQL assistant: Describe what you want in plain English and get a ClickHouse SQL query. Works with OpenAI, Claude, and compatible APIs.
- API tokens: Generate API tokens for programmatic access to Logchef from scripts and automation.
- Log Explorer: Search and filter your logs in real-time with an intuitive interface.
- LogchefQL: Simple query language for filtering logs:
level="error" service="api" - Full SQL mode: Write raw ClickHouse SQL for advanced queries, aggregations, and joins.
- Saved queries: Save your frequently used queries and share them with your team.
- Team workspaces: Organize users and sources into teams with role-based access control.
- Time histogram: Visual chart showing log volume over time.
- Dark & light themes: Choose your preferred appearance.