SiftLog Platform Documentation

Last updated: April 1, 2026 · 4 min read

SiftLog Platform

Version 1.0.0  |  Go 1.26  |  Windows • Linux • macOS • Android

SiftLog Platform is a production-grade log correlation daemon. It reads from every log source in your infrastructure simultaneously, merges them into a single time-ordered stream, and runs three signal detectors continuously. Cascade failures, anomaly spikes, and service silence — detected and named in under a second. Signals stream live to the free SiftLog Android app over your LAN or VPN. No agents. No instrumentation changes. No schema requirements.

Documentation

Overview Architecture, supported sources, platform binaries, and the three signal types.
Installation & Activation Download, install, activate your license, and run as a system service on Linux or Windows.
Configuration Reference Every config field documented. All six source types with full examples. Environment variable overrides.
Signal Detection How cascade, anomaly, and silence detection work. Tuning guidance. Alert thresholds. SQLite signal history queries.
REST API HTTP API for signal history, live event stream, and source health. Powers the free SiftLog Android app and custom integrations.
Troubleshooting License errors, source connection failures, signal tuning, and terminal rendering issues.

Quick Reference

Activate a license

siftlogd activate --key YOUR-LICENSE-KEY

Start the daemon

siftlogd start
siftlogd start --config /etc/siftlogd/siftlog.yaml
siftlogd start --no-ui

Minimal config

sources:
  - name: my-service
    type: file
    path: /var/log/my-service.log
    tail: true
    seek_to_end: true

signal:
  cascade_detection: true
  silence_detection: true
  anomaly_threshold_multiplier: 10.0

Enable the REST API and Android app

api:
  enabled: true
  port: 8080
  bind: 0.0.0.0       # or your server's LAN IP
  api_key: YOUR_KEY

Query signal history

sqlite3 ~/.siftlogd/signals.db \
  "SELECT created_at, signal_type, service, cascade_from FROM signals ORDER BY id DESC LIMIT 20;"

Supported Sources

Type Config value
Local log files file
Grafana Loki loki
AWS CloudWatch Logs cloudwatch
Elasticsearch / OpenSearch elasticsearch
Datadog Logs API datadog
Google Cloud Logging googlecloud

Support: support@mmediasoftwarelab.com   
Licensing: license@mmediasoftwarelab.com   
Open source library: github.com/mmediasoftwarelab/siftlog



Android App

The free SiftLog Android app connects directly to your running daemon and streams signals and events in real time. When a cascade fires, your phone knows. When a service goes silent, your phone knows — before you’ve opened a single log file.

Private by design. The app connects directly to your daemon over your LAN or VPN. No cloud relay. No third-party server in the middle. Your signal data never leaves your infrastructure.

Same LAN Set bind: 0.0.0.0 in your config. Enter your server’s LAN IP and API key in the app. Done.
Corporate VPN Connect your phone to the corporate VPN. Use the server’s VPN IP as the daemon address. No config changes to siftlogd required.
Tailscale (recommended) Install Tailscale on the server and on your phone. Use the server’s Tailscale IP in the app. Encrypted end-to-end, no port forwarding, works from anywhere.

Minimal API config to connect the app

api:
  enabled: true
  port: 8080
  bind: 0.0.0.0       # or your server's LAN IP / Tailscale IP
  api_key: YOUR_KEY   # set anything; the app will prompt for it

The SiftLog Android app is free on Google Play. A valid SiftLog Platform license running on the server is required.



Connecting the Android App — 5 Minute Setup

SiftLog is designed for private networks. The Android app talks directly to your daemon — the same way your internal tools talk to each other — over your existing VPN or network. There is no cloud relay and no account to create.

Step 1: Enable the API in siftlog.yaml

api:
  enabled: true
  port: 8080
  bind: 0.0.0.0
  api_key: choose-any-key

Step 2: Restart the daemon

siftlogd start

Step 3 — Connect your phone

On the same LAN: open the app, enter http://<server-lan-ip>:8080 and your API key.

Over Tailscale (recommended for remote access): install Tailscale on the server and on your phone. Use the server’s Tailscale IP (100.x.x.x) as the address. Encrypted end-to-end, no port forwarding, works from anywhere on any network.

Over corporate VPN: connect your phone to your VPN. Use the server’s VPN subnet IP as the address. No changes to siftlogd required.

The app will begin streaming signals immediately. Each signal type — cascade, anomaly, silence — is color-coded. The source health view updates in real time as the daemon detects changes.

Support: support@mmediasoftwarelab.com   
Licensing: license@mmediasoftwarelab.com   
Open source library: github.com/mmediasoftwarelab/siftlog

// real.developer.js
const approach = {
investors: false,
buzzwords: false,
actualUse: true,
problems: ['real', 'solved']
};
// Ship it.

Built by People Who Actually Use the Software

M Media software isn't venture-funded, trend-chasing, or built to look good in pitch decks. It's built by developers who run their own servers, ship their own products, and rely on these tools every day.

That means fewer abstractions, fewer dependencies, and fewer "coming soon" promises. Our software exists because we needed it to exist — to automate real work, solve real problems, and keep systems running without babysitting.

We build software the way it used to be built: practical, durable, and accountable. If a feature doesn't save time, reduce friction, or make something more reliable, it doesn't ship.

✓ Every feature solves a problem we actually had
✓ No investor timelines forcing half-baked releases
✓ Updates add value, not just version numbers
✓ Documentation written by people who got stuck first

This is software designed to stay installed — not be replaced next quarter.

🤖
Support Bot
"Have you tried restarting your computer? Please check our knowledge base. Your ticket has been escalated. Estimated response: 5-7 business days."
❌ Corporate Script Theater
👨‍💻
Developer (M Media)
"Checked your logs. Line 247 in config.php — the timeout value needs to be increased. Here's the exact fix + why it happened. Pushed a patch in v2.1.3."
✓ Real Technical Support

Support From People Who Understand the Code

Ever contact support and immediately know you're talking to someone reading a script? Someone who's never actually used the product? Yeah, we hate that too.

M Media support means talking to developers who wrote the code, understand the edge cases, and have probably hit the same problem you're dealing with. No ticket escalation theatrics. No "have you tried restarting?" when your question is clearly technical.

Documentation written by people who got stuck first. Support from people who fixed it.

We don't outsource support to the lowest bidder or train AI on canned responses. When you ask a question, you get an answer from someone who can actually read the logs, check the source code, and explain what's happening under the hood.

✓ Real troubleshooting, not corporate scripts
✓ Documentation that assumes you're competent
✓ Email support that doesn't auto-close tickets
✓ Updates based on actual user feedback