This release fixes Explorer navigation, hardens security and makes alerts and exports reliable. It adds few features. Metadata migrations run automatically at startup: SQLite to version 38 and Postgres to version 12. Back up the metadata database before upgrading. On SQLite, sessions stored with a non-UTC timestamp are revoked, so some users must sign in again.
Upgrade notes
Production config sample: The shipped config.toml sets secure_cookie = true, leaves OIDC commented out and leaves api_token_secret empty. Logchef refuses to start until you set the secret. Set secure_cookie = false if you serve Logchef over plain HTTP.
Webhook destinations: Alert webhooks reject private, loopback, link-local, CGNAT and IPv6 translation addresses by default and do not follow redirects. Allow internal receivers with alerts.webhook_allowed_hosts.
Metrics: The user_email label is removed. Update dashboards that group by it.
Startup: A --config file that Logchef cannot read stops startup instead of falling back to defaults.
Frontend URL: Only a signed-in session can change it in the Admin UI, not an API token. Base URLs must be absolute http or https URLs.
Log fields: Request, request error and panic recovered logs use a redacted route template instead of the raw path. Update dashboards and alerts that filter on path.
Query templates: Blocks without variables, such as [[ AND active = true ]], keep their brackets so SQL arrays survive. Remove the brackets or add a variable to such queries.
Added
Export recovery per replica: export.instance_id lets Logchef recover a replica's interrupted exports at once instead of waiting for the age-based fallback.
Delivery state in alert history: History shows each notification target's result, and a retry sends again only to the targets that failed.
Straight to SSO: When SSO is the only sign-in method, the login page sends users straight to the identity provider. It still shows the page after a logout or a failed sign-in (#190).
Changed
Explorer navigation: One owner handles navigation and the URL, and one handles query runs. A page load runs the query once, a connected source is picked first, a bare URL gets its query written back, and Back and Forward restore the right view. Window, zoom and limit changes rerun the last query that ran, not unrun editor text. An edited saved query stays selected and offers Update.
Links that cannot open: A link to a team you cannot access shows a message and runs nothing. A link to an unavailable source opens a fallback source, names both sources and does not run the linked query.
Faster queries and source lists: Queries no longer check the source live before each run, and source lists serve health from provider caches.
Configuration: Config file keys are normalized to lowercase before environment overrides apply, and keys that differ only in case are rejected. Local admin emails use the same validation as admin_emails. Non-empty frontend, external and AI base URLs must be absolute http(s) URLs with a host.
Security
OIDC login: PKCE (S256), a nonce bound to a private cookie, bounded callback requests and rejection of padded email claims.
Admin rights: An API token with users:write can no longer grant admin. Role changes are serialized, so concurrent requests cannot demote or remove the last admin.
Queries: ClickHouse alert queries must be a single SELECT and run exactly as validated. Template variables are escaped for each query language.
Secrets: Logs no longer contain share tokens or credentials, API tokens cannot read secret settings, and error responses no longer expose backend details. The login rate limiter has bounded memory, and account emails are capped at 254 bytes.
Fixed
UTC timestamps on SQLite, so session limits, expiry and alert schedules compare correctly.
Reliable alerts: Firing state is preserved, delivery retries are capped, interrupted deliveries are recovered, shutdown no longer records false evaluation errors, and duplicate legacy firings are pruned.
A hung ClickHouse server no longer stalls other queries and health checks. Exports are safe across replicas and restarts.
Provisioning no longer deadlocks with admin deletes, and duplicate team-source links and members are no-ops. Collections and their owners are created atomically.
Web UI: One toast per failure, not two. Late responses no longer overwrite newer state in alerts, the timeline, live tail, the save-query dialog and team settings. Sharing a query in SQL mode no longer fails with HTTP 400. Query errors return the correct HTTP status codes.
Query templates: Optional blocks are recognized by balanced brackets and a variable, using each language's string and comment syntax, and they work in streaming and background exports.
Alert evaluation and webhooks: Alert queries returning any ClickHouse integer or float width are evaluated. Webhook requests share one client with a timeout and bounded reads, and delivery history keeps the HTTP status without the response body. Stopping the server cancels running evaluations.
VictoriaLogs windowed search: Opt in per source to receive newest-first pages with streamed progress, parallel time windows, stream selection, and Stop, Skip, and Retry controls. Background counts show totals, histogram buckets, and coverage as windows finish. Retry failed counts in one action while keeping completed counts. Configure the feature in the source form or provisioning file. Read the windowed-search guide for settings and limits (#116).
Changed
Optimized sources discover schema fields from the last five minutes by default. Increase the schema lookback if fields appear rarely.
Windowed pagination selects a timestamp boundary before sorting full rows, reducing work on dense windows. Searches started with an older cursor must be run again after upgrading.
Fixed
A short page caused by an incorrect VictoriaLogs timestamp boundary is read again across the full window so older rows are not silently omitted.
Search retries retain the next-window cursor and restore completion when no gaps remain. Query and histogram endpoints validate stream filters consistently and reject them for sources other than VictoriaLogs.
Shared collections can be shared with whole teams. Metadata migrations run automatically at startup: SQLite to version 34 and Postgres to version 9. Back up the metadata database before upgrading.
Added
Share a collection with a team: Owners choose Share with team to give every current team member the collection Member role. Membership is live: people who join the team see the collection, and people who leave lose it unless they have another share or a direct membership. A team share never grants Editor or Owner rights, and a direct role takes precedence. Owners can share with teams they belong to; global admins can share their own collections with any team. Owners can remove a share even after leaving the team (#114).
Changed
Source access: Team shares never grant source access. Running, pinning, and editing a query still need access to its source; other items show a lock icon. A collection shared through several teams and a direct membership appears once.
Collection counts: Collections report team_count beside member_count. member_count still counts direct members only, owners included.
Fixed
SQLite alerts now evaluate at their configured interval instead of waiting for the cutoff date to change. Existing timestamps need no migration (#124).
Helm deployments now preserve all configuration sections, use persistent credentials and Dex storage, and support configurable security contexts. Read the chart upgrade guide before upgrading.
The MCP investigation panel applies each new call and runs its query. MCP tools now declare their read-only and closed-world behavior.
Collection detail: GET /api/v1/collections/:id returns the member and item counts instead of zero, so the detail and the list agree.
Collection header no longer shows counts twice, such as "3 3 items".
Removed from a team: Pages without a team in the URL, such as the Library, no longer open Access Denied after someone removes you from your last-used team. On load, Logchef checks the saved team against your current teams and switches to one you still belong to, or clears the selection if none remain.
Logchef 2.3 can now be its own OAuth server for agents and the CLI, and serves MCP at /mcp from the same process. Claude Code, Codex, Cursor and other MCP hosts connect with a browser approval instead of a pasted token. This release adds database migration 33; back up the metadata database before upgrading.
Added
Built-in MCP endpoint: With OAuth enabled, <server.public_url>/mcp serves read tools for profile, teams, sources, schema, LogchefQL and SQL queries, histograms, field values, log context, saved queries and alerts, plus compare_windows, top_values and an investigation panel for hosts that render MCP Apps. Tool calls use the same access checks and query limits as the HTTP API. The separate logchef-mcp server is no longer needed.
Logchef OAuth: Set server.public_url and [auth.oauth] enabled = true to let agents and the CLI sign in through a consent page after the normal Logchef login. Authorization code with S256 PKCE, rotating refresh tokens, and tokens bound to either the API or /mcp. Users review and revoke grants under Settings → Connected apps.
Built-in MCP clients: Claude Code, Codex and Cursor connect with the built-in client ID logchef-mcp; hosted web clients such as Claude.ai and ChatGPT are configured under [[auth.oauth.clients]].
Split UI and API hosts: server.browser_url puts the consent page on a UI host behind an SSO proxy while the CLI and agents use server.public_url.
CLI: logchef agent setup prints the steps to connect a coding agent.
query.mcp_call_timeout_seconds (default 60) bounds each MCP tool call.
Changed
CLI sign-in: logchef auth signs in through Logchef OAuth and needs a server with OAuth enabled. --no-browser prints the URL, and auth --logout revokes the grant on the server. API tokens work as before.
OAuth tokens get team membership access only, also for admins. Admin sessions and API tokens are unchanged.
LogchefQL accepts RFC3339 and fractional-second time ranges on ClickHouse.
Team and source access checks run in the server core for every caller. An unknown path under a source not linked to the team returns 404, and rate-limited routes report the limit before the link check.
Fixed
A saved query or alert that does not exist or is not visible returned 200 with empty data, and alert history returned 500. They now return 404.
Collection errors (403, 404, 409) were reported as 500.
A ClickHouse server that accepted connections but never answered held every query for the full dial timeout. Queries now stop at their own deadline.
logchef doctor reported a saved token's expiry when --token overrode it.
An invalid alert test query returns 400 instead of 500.
Removed
POST /api/v1/cli/token and the oidc.cli_client_id setting. Existing configs that still set cli_client_id load unchanged.
Upgrade notes
Back up the metadata database: migration 33 adds the OAuth tables.
Update the CLI to 0.3.0. Older CLIs cannot sign in to this server and report that oidc.cli_client_id is not set; ignore that message and upgrade. Their saved sessions keep working until they expire.
Logchef 2.2 can run under a subpath behind a reverse proxy and completes the Simplified Chinese interface for sources, access, admin, and library views. The server moved to Fiber v3. There are no database migrations.
Added
Serve under a subpath: Run Logchef at a URL such as https://example.com/logchef/. Set server.frontend_url to the public URL, including the subpath, and have the proxy remove the prefix. Operations → Reverse Proxy has nginx, Caddy, and Traefik examples (#108).
More translated views: Add Source, source management and inspection, Access, Admin settings, query activity, Library views, route titles, and shared widgets use translation keys, with Simplified Chinese translations. Other languages show English for these messages until they are translated (#103).
Changed
Auth cookies use the path of server.frontend_url. Deployments at / are unchanged.
CLI: logchef open keeps the path of the server URL, so it works with a subpath.
Fiber v3: The HTTP server moved from Fiber v2 to Fiber v3, and all Go, frontend, docs, and CLI dependencies are on their latest releases. Building from source requires Go 1.27.
Logchef 2.1 makes the Explorer usable on sources with hundreds or thousands of fields, adds eleven interface languages, and ships a Helm chart. On a 3,000-field VictoriaLogs source, first rows appear in 1.6 seconds instead of 42, and 1,000 rows with every column shown use 73 MB instead of 1.8 GB. There are no database migrations.
Fast on wide schemasThe table, Fields sidebar, and Group by no longer render every field. Switching to 1,000 rows per page takes 0.4 s instead of 17 s.
Eleven languagesEnglish plus Chinese (Simplified and Traditional), Spanish, French, German, Portuguese, Japanese, Korean, Hindi, and Italian, saved to your account.
Helm chartDeploy Logchef with Dex and ClickHouse, with optional Ingress or Gateway API routes.
Exact valuesLarge integers, precise decimals, and nanosecond timestamps are no longer rounded.
Accurate query stats"Rows read" reports what ClickHouse scanned, and logchef_query_total counts each query once.
VictoriaLogs alertsAlert queries read the metric value instead of a label, so Test Query works again.
Added
Interface languages: English, Chinese (Simplified and Traditional), Spanish, French, German, Brazilian Portuguese, Japanese, Korean, Hindi, and Italian, under Settings → Preferences. Non-English translations are first drafts; corrections are welcome.
Helm chart: deployment/helm deploys Logchef with Dex and ClickHouse, with optional Ingress or Gateway API routes.
Bedrock reasoning effort: ai.reasoning_effort (none to max) for reasoning-capable Bedrock models. AI requests can now run for up to 90 seconds.
Show more in the Fields sidebar, which lists 100 fields at a time, and a searchable Group by picker. Search covers all fields.
Changed
Column rendering: The table renders only the columns in view, and cell actions appear on hover or focus instead of on every cell.
VictoriaLogs defaults: Sources show six columns by default. New fields from a query are no longer added as visible columns.
Query stats: "Rows read" and "bytes read" report what ClickHouse scanned, not the number of rows returned.
Fewer requests: LogchefQL results include their parsed conditions, removing a second translate request per query.
Error responses: Cancelled and timed-out queries return 408. Histograms over 5,000 buckets or 16 MiB are rejected with a hint to widen the interval.
Notable fixes
LogchefQL: Number literals stay exact, = null and != null compile to null checks, and malformed queries are rejected instead of dropping conditions.
ClickHouse values: JSON, Dynamic, Variant, map, and byte-array values render the same in buffered and streamed results.
Saved queries: "Save as new" always creates a new query, double-clicking Save no longer creates duplicates, and template variables are escaped correctly.
Live tail keeps up with bursts of rows that share a timestamp.
Explorer: Log rows open their detail panel again, level is no longer truncated to one letter, and collapsed sidebar fields stay collapsed. The ClickHouse source form's auth toggle works again.
Upgrade notes
Stricter LogchefQL: Quote numbers compared with string fields (status_text="500"), and use = null or != null instead of ordering operators. Update saved queries and alerts that rely on the old behavior.
SQL histograms using GROUP BY, DISTINCT, or set operations must select the timestamp column explicitly.
Histogram concurrency: query.max_concurrent_per_user and query.max_concurrent_global apply to previews and histograms separately, so histograms can return 429 under load.
Metrics: logchef_query_total roughly halves because of the double-count fix. Adjust dashboards and alerts.
Helm: The chart defaults are for evaluation. For production, pin logchef.image.tag to v2.1.0 and replace the default OIDC client secret and Dex demo users.
Building from source requires Go 1.26.
Thanks to @AndreyCreativecode for reporting and profiling the wide-schema slowdown (#106) and contributing the sidebar and Group by fixes. Performance figures are medians of five runs; the method is in frontend/docs/table-performance.md.
VictoriaLogs queries from Explore: Valid LogchefQL filters no longer go through the old ClickHouse-only SQL check, which rejected VictoriaLogs sources with Missing required parameters.
CLI errors from streamed queries: When a streaming response fails after it has started, the CLI now shows the server's database error instead of a confusing parse failure.
Demo login credentials: Public demos can opt in with [demo] show_login_credentials = true to show and prefill the local login on the sign-in page. It is off by default, because turning it on makes those credentials public.
Logchef 2.0 is the largest release in the project's history. It grows Logchef from a ClickHouse log explorer into a multi-datasource log exploration platform. VictoriaLogs now sits beside ClickHouse as a first-class datasource, while dashboards, live tail, local authentication, query history, usage analytics, and a substantially more capable CLI turn Logchef into a complete place to investigate and understand logs.
VictoriaLogs, end to endExplore with LogchefQL or LogsQL, inspect fields, build dashboards and alerts, generate queries with AI, and tail logs live.
Dashboards, brand newBuild operational views from log queries. Drag, resize, and preview panels on the grid. Mix time series, stats, tables, horizontal bars, and donut breakdowns.
Live logs everywhereFollow matching rows from either backend in the web explorer or terminal, with server-side stream guardrails.
Deploy your wayUse built-in email and password login with no OIDC dependency, or automatically provision approved users through SSO.
Investigation memoryReturn to your own query history; administrators can see recent activity and all-time usage trends by user and source.
CLI v0.2.1Query both backends, tail, explain, graph histograms, inspect fields, diagnose setup, and jump from the shell into the web explorer.
Added
VictoriaLogs datasource: Connect with no auth, basic auth, or a bearer token; optionally set multi-tenant account/project IDs and an immutable server-side scope. Query it with LogchefQL or native LogsQL across the explorer, dashboards, alerts, field inspection, AI generation, and live tail. Log context and exports remain ClickHouse-only. VictoriaLogs guide →
Built-in local authentication: Run Logchef with email and password accounts, alongside OIDC or without an external identity provider. The configured bootstrap admin can be rotated on restart, and local login attempts are limited by IP and email. Local authentication →
Automatic SSO provisioning: Allow first-time OIDC users from approved email domains to create a regular account and join configured default teams. SSO auto-provisioning →
Live tail: Flip on Live to stream matching rows as they arrive. ClickHouse uses efficient polling; VictoriaLogs proxies its native stream. Session, concurrency, and rows-per-second limits keep a shared instance bounded.
Dashboards: A brand-new module for operational views, mixing ClickHouse and VictoriaLogs panels on one grid. Move and resize panels directly on the canvas, then edit them in a full-height drawer with a live query preview.
More ways to visualize logs: Time-series panels support line, area, grouped bar, or stacked bar charts. Category breakdowns render as horizontal bars or donut charts alongside stat and table panels.
Dashboard result cache: Per-dashboard TTL caching reuses panel results across viewers and refreshes, reducing repeated backend work without caching ad-hoc explorer queries.
Query history and usage analytics: Reopen your recent queries in the explorer or with logchef history. Administrators get recent Query Activity plus durable all-time trends by source and user.
AI for every supported query mode: Generate and validate LogchefQL, ClickHouse SQL, or LogsQL, with one automatic repair attempt for recognized syntax errors. AWS Bedrock joins OpenAI-compatible providers.
Per-source ClickHouse guardrails: Cap execution time, result/read rows and bytes, set read-only mode, and choose overflow behavior for each shared ClickHouse source.
Client-side column filters: Narrow loaded rows from a column header with text matching or numeric comparisons, without issuing another query.
Changed
Datasource-neutral architecture: Source configuration, query compilation, execution, inspection, and UI feature gates now flow through provider capabilities instead of ClickHouse-specific assumptions.
Large ClickHouse results stream progressively: Preview responses no longer buffer the complete result in server memory before returning it.
Credentials stay private: APIs return whether a credential exists, never the stored secret; leaving it blank while editing preserves the current value.
Cleaner, timezone-correct charts: Sparse histograms fill missing buckets with zero, grouped series keep exact totals, and dashboard time ranges align to the viewer's timezone.
Source Stats loads predictably: Metadata and bounded recent activity load and refresh independently, so slow activity queries do not block the whole page.
Security & reliability
Safe dashboard sharing and editing: Stored tooltip XSS is closed, concurrent saves detect conflicts, corrupt panels are isolated, and viewers only receive panels backed by sources they can access.
Hardened VictoriaLogs connections: Auth and tenant headers cannot be overridden, stale credentials are cleared when auth changes, health checks exercise the real query path, and slow request paths have read deadlines.
Request and proxy controls: Opt-in login/query rate limits and trusted-proxy client-IP resolution protect public or shared deployments without trusting spoofable forwarding headers.
Session lifecycle fixes: Deleting a user revokes their sessions immediately, and expired sessions are swept in the background.
Notable fixes
Condition alerts aggregate the selected field for sum, avg, min, and max, on both backends.
Alert evaluation keeps ClickHouse column metadata, fixing successful queries that previously failed only on the alert path.
Saved-query and URL modes stay consistent: LogchefQL, ClickHouse SQL, and LogsQL are validated appropriately, and drafts no longer leak LogchefQL into native mode.
Unsupported exports fail clearly: Sources without export capability hide Download and return a clean 400, rather than starting a doomed job.
Breaking change
Provisioned source shape: Every [[sources]] entry now needs source_type = "clickhouse" or "victorialogs", with provider-specific fields nested under [sources.connection]. Teams, members, descriptions, retention, and metadata-field settings are unchanged. Migration example →
Metadata migrations: SQLite migrations 000025–000032 and Postgres migrations 000002–000007 add datasource-neutral sources, local-auth credentials, dashboards, case-insensitive emails, query history, and durable daily usage stats. They apply automatically; case-only duplicate emails must be resolved manually if detected.
A polished companion to the v2 server and the feature-packed CLI v0.2.0 release: interactive sessions now show the installed version in a Logchef banner and unobtrusively report when a newer stable CLI is available. Both can be disabled for scripts, CI, or quieter terminals.
Added
Startup banner: Interactive runs identify the current CLI version; disable it in config, with an environment variable, in CI, or with --quiet.
Update notification: A cached version check announces newer stable releases without slowing every invocation, with the same opt-out controls.
First public preview of the v2 architecture: VictoriaLogs as a datasource, live tail, local authentication, dashboards, query history, usage analytics, and the datasource-neutral provider layer. The stable v2.0.0 release above includes the completed feature set and hardening work.
The command-line tool catches up with the v2.0 server. It now queries VictoriaLogs sources the same way it queries ClickHouse, follows logs live in your terminal, and adds a handful of commands for exploring and debugging without leaving the shell.
Added
VictoriaLogs support: Query your VictoriaLogs sources from the terminal, just like ClickHouse ones.
Live tail in the terminal: logchef tail now follows matching logs as they arrive, on ClickHouse and VictoriaLogs.
Jump to the web explorer: logchef open opens your current query in the browser, with the query and time range already filled in.
See the query first: logchef explain prints the query Logchef would run, without running it.
Counts over time: logchef histogram shows how often something happens across a time range.
Find your fields: logchef fields lists a source's fields and their common values, so you know what to filter on.
Your recent queries: logchef history reopens queries you ran earlier.
Check your setup: logchef doctor diagnoses server, auth, and source problems when something isn't working.
Shell completions: logchef completions for bash, zsh, and fish.
Logchef 1.7 makes the metadata store pluggable. Alongside the default single-binary SQLite, you can now run an opt-in Postgres backend so multiple Logchef replicas share state behind a load balancer. That's the groundwork for high availability. SQLite stays the default, so single-instance setups are unchanged. The release also lets you switch alerting off server-wide, opens collection curation to any participant, adds an admin "All Queries" browse view, and brings type-to-filter pickers and searchable, sortable tables to the member and resource pages.
Added
Opt-in Postgres metadata backend: Store users, teams, sources, saved queries, collections, alerts, tokens, and settings in Postgres instead of SQLite, so several Logchef replicas can serve any request off shared state. Set database.driver = "postgres" with a [postgres] DSN (or the matching env vars). SQLite remains the default and the single-binary start is unchanged; your logs always stay in ClickHouse. Database backends & HA →
Turn alerting off server-wide: Set alerts.enabled = false and the UI hides alerting entirely while every alert endpoint returns a clean 503. Useful when you run Logchef purely for exploration, or want a single alert-evaluating instance.
"All Queries" browse for admins: Global admins can now see every saved query, including ones not pinned to any collection. Queries on sources you can't reach show as locked.
Redesigned Library: Saved queries and collections merge into a single /logs/library (collections rail + detail pane). Collections gain an editor role, and editing a saved query is delegated to its creator, a global admin, or an owner/editor of a shared collection that contains it. The Save dialog gets an inline collection picker, and the UI only offers Edit/Delete actions you're actually allowed to take.
Curate shared collections as a member: Any participant (owner, editor, or member) can pin, move, and remove queries in a shared collection. Renaming, deleting, and managing members stays owner-only.
Collection detail upgrades: Pin an existing saved query with an "Add query" search picker, move a query to another collection, and see each query's author in a new "Created by" column.
Searchable pickers & tables: Type-to-filter dropdowns for inviting collection members and adding service accounts to teams, plus a search box and sortable columns on Manage Sources and team-member lists.
Token expiry everywhere: The service-tokens admin page now shows the same expiry status as the profile API-token list (never expires / expires / expiring soon / expired), and the CLI flags an expired saved token in logchef auth current.
Changed
Pluggable store architecture: The metadata layer now sits behind a backend-agnostic contract with a shared conformance suite that runs against both SQLite and Postgres in CI, so the two backends stay in lockstep.
Upgraded to Go 1.26 with hot-path optimizations across query handling.
Collection member list is owner-only: now enforced on the server, not just hidden in the UI.
Fixed
Inline permission errors show a toast instead of bouncing you to a full-page Forbidden view. Toggles, saves, and deletes stay put on a 403.
Dead toggles work again: several Switch/Checkbox controls (admin Active toggle, alert enable/disable, source TLS/auth, column selector, variable multi-selects) were silently no-op'd by a binding mismatch and now respond.
Saved-query resolver no longer crashes on certain resolve paths; it returns a clean error instead.
Accurate access errors for exports and shared queries: 404 only when something's missing, 403 when you lack team access.
Tighter memory accounting on large responses (fixes an under-count from the performance pass), cancellable field-value loading, and identifier validation on provisioned sources.
UI polish: the add-query dialog no longer overflows, the Library "All queries" view survives navigation, and the date picker's type drift is fixed (TypeScript checks are green and enforced in CI again).
Patch release. Adds Service accounts: non-login principals you can add to teams and issue scoped API tokens for. Every token now carries an explicit scope list (e.g. logs:read, alerts:write) enforced by middleware, with presets and an active-preset highlight in the picker. The team member dialog distinguishes humans from service accounts, and service principals get a clear badge in team rosters. Also surfaces ClickHouse column comments through the schema API for the new Logchef CLI v0.1.6 to consume.
Added
Service accounts: Non-login principals managed at Administration → Service Tokens. Cannot authenticate via OIDC or CLI exchange; exist only to own tokens and team memberships. Learn more →
Scoped API tokens: Tokens now carry an explicit list of scopes (logs:read, alerts:write, …). Presets in the picker: Read-only, Logs viewer, Logs analyst, Alerts manager, Source admin, Full access. The active preset stays highlighted while the selection matches.
Account-type toggle in Add Team Member: Pick Human user or Service account; the dropdown filters to that type and shows the principal's name with email as a subtitle instead of the raw service-account email.
Service account badge in team member tables: a bot icon and "Service account" pill so automation principals are visually distinct from humans.
Manage teams on each service account card: team chips, a destructive warning when an account is in zero teams (its tokens won't reach any source), and an in-place add/remove dialog.
Schema column descriptions: The schema API now surfaces ClickHouse column comments. Consumed by Logchef CLI v0.1.6's schema command.
Changed
"Create API Token" defaults to the Read-only preset. Previously defaulted to Full access, which made the scope picker look entirely disabled out of the box.
Read-only preset is now every :read scope. Adds tokens:read, users:read, settings:read. Admin-gated routes still enforce admin role separately.
/admin/users/* routes 404 on service accounts. Service principals are managed via the dedicated /admin/service-accounts/* path so they can't be promoted through the human-user CRUD path.
Fixed
Scope picker checkboxes are interactive again. The component was bound to :checked; the underlying primitive uses model-value. The bug was hidden behind the old Full-access default.
Token creation rejects empty scopes (HTTP 400). Requests with no scopes used to silently mint a full-access token.
Corrupt or empty stored scopes fail closed. A token row with malformed scope JSON now grants no access instead of full access.
Major CLI release. Adds four new subcommands (saved-queries, find, tail, whoami, auth current), full time-range injection on raw SQL, agent-friendly output formats (msg, json-flat), a symmetric --explain / --dry-run split across query and sql, and TTY-aware highlighting so pipes don't need --no-highlight. Requires Logchef server v1.6.1+ for the saved-queries resolve endpoint and ClickHouse column descriptions.
Added
saved-queries: List and run saved queries by name, numeric ID, or a pasted explorer URL. --var, --limit, --show-sql, and all output-format overrides supported.
find <pattern>: Discover sources with recent matches for a service, job, host, or message pattern. Each match line is followed by per-column samples: label-shaped columns (service/host/job_name) get the top 3 values with counts; free-form text columns (msg) get one truncated sample row. Suppress with --no-samples. Per-source timeout defaults to 30s.
tail <query>: Follow matching LogchefQL rows by polling. text, jsonl, or msg output; stable dedup across column-order changes; one-shot stderr warning when a poll returns at --limit.
whoami: Print the authenticated user and accessible teams.
auth current: Offline subcommand that prints the active context, server URL, and token source (config vs env), plus the token expiry when it came from saved config. No network call. Useful for "is my LOGCHEF_AUTH_TOKEN even set?" diagnostics.
SQL time flags on sql: --since / --from / --to inject a timestamp predicate before the first top-level GROUP BY / ORDER BY / LIMIT / HAVING / SETTINGS / FORMAT. The scanner skips string literals, quoted identifiers, comments, and parenthesized subqueries; use __START__ / __END__ placeholders for full control (e.g. CTEs).
--explain / --show-sql on query and sql: Print Generated SQL: <sql> to stderr, then continue executing. Plays cleanly with --output jsonl | jq pipes.
--dry-run on query and sql: Print the resolved SQL to stdout (no prefix) and exit without keeping results. sql --dry-run is fully offline; query --dry-run calls the server once for LogchefQL translation.
--output msg: Print only the message column (one row per line) on query, sql, collections, and saved-queries. Falls back to the first selected column when msg isn't projected.
--output json-flat: Hoist JSON-shaped msg fields to top-level JSON rows on query, sql, collections, and saved-queries.
LOGCHEF_DEFAULT_TEAM / LOGCHEF_DEFAULT_SOURCE: Env defaults when --team / --source are omitted. Precedence: flag → env → saved config.
Schema column descriptions: schema --output text shows a new DESCRIPTION column when the source's ClickHouse columns carry comments; schema --output json includes them inline.
Changed
Highlighting auto-disables on non-TTY output. All five subcommands (query, sql, collections, saved-queries, tail) skip ANSI escapes when stdout is piped, so ... | jq and ... > file produce clean output without --no-highlight. The flag still works as an explicit override.
CSV export & streaming SQL: New --output csv and --stream flags on logchef sql. Stream large result sets directly without timing out, or pipe them to a CSV file.
v1.6.0 API compatibility: CLI now works with Logchef 1.6's de-teamed collections API. Saved queries resolve from your team membership automatically.
Changed
Product name standardized: "LogChef" → "Logchef" throughout all CLI help text, prompts, and auth pages.
Logchef 1.6 reorganizes saved queries around Collections: cross-team curation lists you can share with teammates. Teams now exist purely for access control. A new Editor team role sits between Member and Admin: editors can save queries and manage collections without getting full admin rights.
Added
Collections: Group saved queries into shareable lists. Everyone gets a personal collection automatically. Shared collections are invite-only; queries you can't run show with a lock icon.
Unified Saved Queries page: One place to browse, search, and pin queries. Pick "All Queries", your personal collection, or any shared collection from a dropdown at the top.
"Add to Collection" drawer: Open the menu on any saved query and tick the collections you want it pinned to. Create new collections inline.
Editor team role: A new role for teammates who curate queries and collections. Editors can save queries, create collections, and invite collection members. They can't invite team members or link sources; those stay admin-only.
Share a saved query with a link: /logs/saved/:queryId resolves the right team and source automatically, so the recipient lands directly on the query.
CSV / JSON downloads stream from the backend with admission control, so very large exports don't tip the server over.
Calendar month/year drill-down in the date picker.
OIDC skip_email_verified_check: Skip the email-verified claim on providers that don't pass it through (e.g. Cloudflare Access in front of an upstream IdP). (#86)
Native ClickHouse TLS: Configure TLS directly in the source connection instead of relying on stunnel/sidecars. (#88)
Changed
Save your own queries. The Save button is now visible to every team member (it was hidden from non-admins by mistake). Editing or deleting a saved query still requires the original creator or a global admin.
Distinct icons for LogchefQL and SQL in the saved queries list, so you can tell them apart at a glance.
Cleaner admin and settings pages: consistent header, sections, and empty-state styling across Users, Teams, Sources, System Settings, Profile, and Preferences.
Saved queries belong to a source, not a team. Anyone with source access can see and run them. The team you saved from is just a hint used to pick the right access path.
Explore UI polish: quieter top bar, concrete query placeholders, Local|UTC timezone toggle.
Removed
Query Folders: replaced by Collections.
Bookmarks: your starred queries automatically move to your personal collection.
Fixed
Very large query results are now capped ([query] max_limit, default 100k rows) so the browser doesn't run out of memory.
Long raw SQL in the URL no longer trips the server's HTTP header size limit.
Switching sources is race-free: the explorer waits for the new source's schema before running a query, and a slower in-flight response can't overwrite a faster one.
Saved queries open against the right source: the query's source overrides any stale source param in the URL.
Export job pruner is crash-safe: interrupted prunes no longer leave orphaned download files.
Translate API errors are surfaced to the editor instead of failing silently.
Export download URLs are relative, so downloads work behind reverse proxies that rewrite hostnames.
Smart value autocomplete: Type host= in LogchefQL and get instant value suggestions with occurrence counts from the field sidebar. Works inside quotes, auto-wraps strings, and escapes special characters.
Numeric field exploration: Fields like status (UInt16) now auto-load their top values in the sidebar, just like LowCardinality fields.
Changed
New visual theme: Upgraded to Tailwind CSS v4 with Vega/Zinc/Blue theme, sharper borders, and bolder chart colors
Sidebar collapsed by default: More screen space for logs. Expand via rail hover or Cmd+B
Theme toggle: One-click light/dark/system cycle in the sidebar footer
Histogram redesign: New Unovis-based charts with brush-drag zoom and crosshair tooltips
Lazy-loaded Monaco editor: SQL editor loads on demand for faster initial page load
Fixed
Hyphenated field names: Fields like user-identifier now work correctly in all queries (was causing SQL subtraction errors)
Better error codes: Invalid field names and query parameters now return HTTP 400 instead of 500
Histogram reliability: Fixed tooltip styling, null data crashes, 1-second bucket support, and brush zoom interaction
Team admin permissions: Team admins can now manage members on provisioned teams
Connection cleanup: Added idle timeout and periodic query tracker cleanup
Canonical request logging & activity logs: Every API request emits a structured line with method, path, status, latency, user, and team. A companion activity log tracks user-visible state changes for audit.
Changed
Product name standardized to "Logchef": Lingering "LogChef" casing replaced across the UI, docs, and log lines.
Session-management logs dropped to DEBUG: Only user.login stays at INFO; the rest was audit-grade noise.
slog source field flattened to file:line: Easier to grep, fewer bytes per line.
Fixed
Team admins can manage members on provisioned teams. The managed flag was locking them out of all membership edits.
Idle ClickHouse connection cleanup: Added IdleTimeout and a periodic QueryTracker sweep so leaked connections don't accumulate.
Provisioning docs moved into the sidebar with a clearer "Getting started" sub-section.
Declarative provisioning: Define teams, sources, and access control in a TOML config file for GitOps workflows. Supports dry-run mode, managed vs unmanaged resources, and a separate provisioning.toml file. Learn more →
All Teams collections: Browse saved queries across all your teams from a single page with the new "All Teams" option in the team dropdown.
Fixed
Query cancellation: LogchefQL queries now properly cancel end-to-end (was a no-op)
SQL mode integrity: Time/limit changes no longer silently rewrite raw SQL queries
Histogram accuracy: Timestamp field detection limited to SELECT clause only
Post-login redirect: Users return to their original page after OIDC login
Calendar UX: Date picker highlights today with default times (00:00:00 / 23:59:59)
No duplicate queries: Page load no longer fires the same query twice
Configurable query result limit: New [query] max_limit config option (default: 1M rows). Export up to 1 million rows when your infrastructure supports it.
User preferences persistence: Your theme, timezone, display mode, and fields panel state now persist across sessions. No more re-setting preferences after every login.
Team admins can manage their teams: Team admins now have access to team settings and member management without needing global admin privileges.
Source editing and duplication: Edit existing source configurations and quickly duplicate sources for similar setups.
Changed
SQL editor max height: Editor now caps at 300px with scrollbar for lengthy queries, leaving more room for results
Fixed
Histogram Group By: Histogram now auto-refreshes when changing the Group By column
Dark mode date picker: Time icon now visible in dark mode
Date picker improvements: Now button auto-applies and initial date format issues resolved
JSON auto-parsing: JSON strings embedded in log fields now display as formatted objects
Version sidebar matches the running binary: The versionString linker flag is wired through to the UI, so the version badge no longer falls back to unknown.
Alertmanager UI settings removed: Obsolete after the SMTP / webhook alert delivery work in v1.2.0.
Fixed
TLS migration description corrected: The migration description for the alert-TLS toggle was misleading.
Changelog template syntax escaped: {{ ... }} examples now render literally instead of being interpolated.
--timeout on query: Override the server-side query timeout from the CLI.
Timezone auto-detection on auth: logchef auth records your local IANA timezone in the saved context so subsequent queries use it by default. Config gained a version field for future schema migrations.
Pre-built binary install docs: docs/integration/cli now lists download URLs for Linux x86_64/aarch64, macOS x86_64/aarch64, and Windows.
Fixed
LogchefQL prompt example: Interactive mode now shows level="error" instead of the older unquoted form.
Logchef CLI: Query your logs from the terminal with syntax highlighting, multi-context support, and all the features of the web UI. Learn more →
Multi-select variables: Select multiple values for a variable and they expand to IN (...) clauses. Great for filtering by multiple hosts or services at once.
Optional SQL clauses: Wrap SQL clauses in [[ ... ]] and they're automatically removed when the variable is empty. No more "WHERE 1=1" hacks.
Variable dropdowns: Configure variables as text inputs, dropdowns, or multi-selects with default values.
Browse all saved queries: New "All Sources" view in Collections to see saved queries across your entire team.
Direct email & webhook alerts: Send alert notifications via SMTP or webhooks without needing Alertmanager.
Fixed
No more database lock errors: Fixed intermittent "SQLITE_BUSY" errors that could occur during high traffic
Time ranges now refresh before each query (relative times like "last 1 hour" update correctly)