MIT License

SiftLog - Open Source

Evaluate the engine
before you license the platform.

The SiftLog correlation engine, all three signal detectors, and all log source adapters are open source and can be reviewed in full. The CLI is free. No account, no signup, no credit card. Run it against your logs right now.

View on GitHub SiftLog Platform (Production)

Quick Start

Install. Point at logs.
See what breaks first.

One Go install command. No configuration file required for basic use. Pass your log files as arguments and the CLI starts correlating immediately.

Works against local log files out of the box. The same adapters that power the Platform daemon (Loki, CloudWatch, Elasticsearch, Datadog, Google Cloud Logging) are available in the library and usable from the CLI with a minimal YAML config.

Current release: v0.3.0

terminal
# Install $ go install github.com/mmediasoftwarelab/siftlog@latest # Run against local log files $ siftlog app.log worker.log auth.log SiftLog v0.3.0 - 3 sources active [signal:cascade] auth-service -> api-gateway 03:14:19 auth-service ERROR db pool exhausted 03:14:19 auth-service ERROR token validation timeout 03:14:19 api-gateway ERROR auth-service unavailable 03:14:20 api-gateway ERROR circuit breaker OPEN [signal:silence] worker - no events in 2m34s noise suppressed: 4,201 events | signal: 4 events

What Is Open Source

The entire engine.
Reviewable. Embeddable. Free.

This is not a stripped-down evaluation build. The open source library is the production correlation engine. You can review exactly how it works, embed it in your own Go applications, and run the CLI in CI pipelines or post-mortem scripts without a license.

Cascade Detector

The full cascade detection engine - per-service sliding windows, trace ID correlation, propagation chain identification. Same code that runs in siftlogd.

Anomaly Rate Detector

Rolling baseline tracking and configurable multiplier thresholds for per-service error rate anomalies. Fully configurable via code or YAML.

Silence Detector

Per-service event volume tracking with configurable drop threshold. Flags services that go quiet - a failure mode that dashboards consistently miss.

All Six Source Adapters

Loki, CloudWatch, Elasticsearch, Datadog, Google Cloud Logging, and local file adapters. All open source, all reviewable, all embeddable.

CLI for Manual Use

Pass log files directly on the command line. Use a YAML config for remote sources. No daemon, no UI, no license required. Useful in CI, scripts, and post-mortems.

Go Library for Embedding

Import the library directly in any Go application. The correlator and all detectors are designed to be embedded. Read the source, fork it, build on it.

Go Library

Embed the correlator
in your own tooling.

The library is designed to be imported directly. Build SiftLog into your own observability pipeline, CI test runner, or incident response tooling.

The Platform daemon (siftlogd) is built on top of this library and adds the always-on runtime, persistent signal storage, terminal UI, alerting integrations, and web interface. The library itself does not require a license.

your-app/main.go
import ( "github.com/mmediasoftwarelab/siftlog/correlator" "github.com/mmediasoftwarelab/siftlog/adapters/loki" ) // Create a correlator with your config c := correlator.New(correlator.Config{ CascadeWindowMs: 2000, AnomalyMultiplier: 3.0, SilenceThreshold: 0.25, }) // Attach a source adapter c.AddSource(loki.New(loki.Config{ URL: "http://loki:3100", Query: "{job=\"prod\"}", })) // Handle signals however you want c.OnSignal(func(s correlator.Signal) { // page, log, webhook, whatever })

Open Source vs Platform

Start free. License when
you need it in production.

The open source CLI is for evaluation and one-off use. The Platform daemon is for production - always-on, always correlating, with persistent history and alerting.

Capability Open Source CLI SiftLog Platform
Cascade, anomaly, silence detection Yes Yes
All six source adapters Yes Yes
Run against local log files Yes Yes
Always-on daemon (siftlogd) No Yes
Terminal UI No Yes
Persistent signal history (SQLite) No Yes
Alerting (email, PagerDuty, Slack) No - planned Yes - planned
Web interface No - planned Yes - planned
License required No - MIT Yes - $990/server/year

Ready for production?

When you need SiftLog running continuously - always correlating, always storing signals, with alerting and a web interface - that is what the Platform is for.

See SiftLog Platform