LogChef

https://logchef.app/
Admin
LogChef is a log explorer for ClickHouse that enables querying billions of logs in milliseconds with...
Tokens:31,918
Snippets:356
Trust Score:6
Update:9 months ago
Show doc for...
Tokens:
Raw
### Install Logchef with Binaries

Source: https://logchef.app/getting-started/quickstart

Installs Logchef using pre-built binaries for Linux. It downloads the latest release, extracts the archive, makes the binary executable, downloads a default configuration file, and runs Logchef with the specified configuration. Requires manual configuration updates for OIDC and database paths.

```bash
# Download the latest release for your platform (example for Linux amd64)
# Check latest version at https://github.com/mr-karan/logchef/releases
curl -L -O https://github.com/mr-karan/logchef/releases/download/v0.2.1/logchef_0.2.1_linux_amd64.tar.gz

# Extract the archive
tar xzf logchef_0.2.1_linux_amd64.tar.gz

# Make the binary executable
chmod +x logchef

# Create a basic configuration file
curl -L -O https://github.com/mr-karan/logchef/raw/main/config.toml

# Edit the config file to match your environment
# You'll need to update the OIDC settings and database path

# Run Logchef with your config
./logchef -config config.toml
```

--------------------------------

### Logchef Basic Query Examples

Source: https://logchef.app/getting-started/quickstart

Provides basic examples of Logchef query syntax for filtering logs. These examples demonstrate filtering by namespace, excluding specific severity levels, and searching for text within the log body.

```logql
namespace="syslog"
```

```logql
namespace="syslog" and severity_text!="INFO"
```

```logql
namespace="syslog" and body="error"
```

--------------------------------

### Install Logchef with Docker

Source: https://logchef.app/getting-started/quickstart

Installs and runs Logchef, Clickhouse, Dex SSO, and Vector using Docker Compose. It downloads the docker-compose.yml file and starts the services in detached mode. Assumes Docker is installed and running.

```bash
curl -LO https://raw.githubusercontent.com/mr-karan/logchef/refs/heads/main/deployment/docker/docker-compose.yml
docker compose up -d
```

--------------------------------

### Build Logchef from Source

Source: https://logchef.app/getting-started/quickstart

Builds Logchef from source code by cloning the repository, building the frontend and backend using the 'just' build tool, and then running the application with the default configuration. Requires Git and the 'just' build tool to be installed.

```bash
# Clone the repository
git clone https://github.com/mr-karan/logchef.git
cd logchef

# Build the frontend and backend
just build

# Run with the default config
just run
```

--------------------------------

### LogchefQL Example: Finding Errors

Source: https://logchef.app/guide/search-syntax

A straightforward example demonstrating how to filter logs specifically for entries marked with the 'error' level.

```LogchefQL
level="error"
```

--------------------------------

### LogchefQL Example: Performance Analysis

Source: https://logchef.app/guide/search-syntax

Shows how to use comparison operators to identify logs related to request performance, such as slow or very fast requests.

```LogchefQL
# Slow requests (over 1 second)
response_time>1000
```

```LogchefQL
# Very fast requests (under 10ms)
response_time<10
```

--------------------------------

### Configure Alerting via Environment Variables

Source: https://logchef.app/getting-started/configuration

This example shows how to configure alerting settings, including enabling alerts and setting the Alertmanager URL and frontend URL, using environment variables. This method provides flexibility for dynamic configuration of the alerting system.

```bash
export LOGCHEF_ALERTS__ENABLED=true
export LOGCHEF_ALERTS__ALERTMANAGER_URL="http://alertmanager:9093"
export LOGCHEF_ALERTS__FRONTEND_URL="https://logchef.example.com"

```

--------------------------------

### LogchefQL Example: Partial Text Search

Source: https://logchef.app/guide/search-syntax

Demonstrates using pattern matching operators to find logs containing specific text within message or path fields.

```LogchefQL
# Find logs containing "timeout"
message~"timeout"
```

```LogchefQL
# Find paths not containing "internal"
path!~"internal"
```

--------------------------------

### LogchefQL Example: Nested Field Queries

Source: https://logchef.app/guide/search-syntax

Provides examples of filtering logs based on values within nested fields, including pattern matching on nested JSON data.

```LogchefQL
# Filter by nested attribute
log_attributes.user_id="user-123"
```

```LogchefQL
# Pattern match in nested JSON
body~"error" and log_attributes.request.method="POST"
```

--------------------------------

### Start Vector Log Collection Service

Source: https://logchef.app/tutorials/nginx-logs

This command initiates the Vector log collection agent using a specified configuration file. Ensure the path to your `vector.toml` configuration is correct for the agent to start processing and shipping logs.

```bash
vector --config /path/to/vector.toml
```

--------------------------------

### Logchef Example Queries for NGINX Logs

Source: https://logchef.app/tutorials/nginx-logs

A collection of example Logchef queries demonstrating how to analyze NGINX access logs stored in ClickHouse. These queries cover common scenarios like identifying server errors, slow requests, large responses, specific API endpoints, and time-based filtering.

```logql
# Find all server errors
status >= 500

# Find slow requests (taking more than 1 second)
request_time > 1.0

# Find large responses
bytes_sent > 1000000

# Find specific API endpoints
request_uri:"/api/users"

# Combine multiple conditions
status=404 AND remote_addr="192.168.0.1"

# Time-based queries
timestamp > '2025-04-20 00:00:00' AND timestamp < '2025-04-25 23:59:59'
```

--------------------------------

### Monitor Query Performance

Source: https://logchef.app/operations/metrics

These examples demonstrate how to monitor query performance by calculating average query duration and success rates per source using Prometheus.

```PromQL
# Average query duration per source
rate(logchef_query_duration_seconds_sum[5m]) / rate(logchef_query_duration_seconds_count[5m])


# Query success rate by source
rate(logchef_query_total{result="success"}[5m]) / rate(logchef_query_total[5m])
```

--------------------------------

### Get Service Overview

Source: https://logchef.app/guide/examples

A LogchefQL query to obtain a high-level overview of service activity. It retrieves the timestamp, service name, and log level for logs within a specific namespace ('production'). This helps in quickly assessing the general state of services.

```LogchefQL
namespace="production" | timestamp service_name level
```

--------------------------------

### Monitor ClickHouse Health

Source: https://logchef.app/operations/metrics

This example demonstrates how to monitor ClickHouse connection health by identifying sources with connection issues and calculating the connection failure rate.

```PromQL
# Sources with connection issues
logchef_clickhouse_connection_status == 0


# Connection failure rate
rate(logchef_clickhouse_connection_validation_total{result="failure"}[5m])
```

--------------------------------

### Logchef Example Queries with Enrichment Fields

Source: https://logchef.app/tutorials/nginx-logs

These Logchef queries leverage the previously added enrichment fields in ClickHouse for more refined NGINX log analysis. Examples include filtering logs by environment and status category, or by specific API versions.

```logql
# Find all errors in production
environment="production" AND status_category="error"

# Find v2 API calls
api_version="2"
```

--------------------------------

### Override AI API Key via Environment Variable

Source: https://logchef.app/getting-started/configuration

This example shows how to set the AI API key using an environment variable. This is a secure way to handle sensitive credentials, particularly in production or CI/CD pipelines, ensuring the key is not hardcoded in configuration files.

```bash
export LOGCHEF_AI__API_KEY="sk-your_actual_api_key_here"

```

--------------------------------

### Alertmanager Configuration Example

Source: https://logchef.app/features/alerting

This is a sample Alertmanager configuration file that defines global settings, routing rules for different severities, and receivers for notifications like PagerDuty and Slack.

```yaml
global:
  resolve_timeout: 5m


route:
  receiver: 'default-receiver'
  group_by: ['alertname', 'severity', 'team', 'source']
  group_wait: 10s
  group_interval: 30s
  repeat_interval: 12h


  routes:
    # Critical alerts to PagerDuty
    - match:
        severity: critical
      receiver: 'pagerduty'
      continue: true


    # Warning alerts to Slack
    - match:
        severity: warning
      receiver: 'slack-oncall'

receivers:
  - name: 'default-receiver'
    webhook_configs:
      - url: 'http://webhook-receiver:8080/alerts'


  - name: 'pagerduty'
    pagerduty_configs:
      - service_key: 'YOUR_SERVICE_KEY'


  - name: 'slack-oncall'
    slack_configs:
      - api_url: 'https://hooks.slack.com/services/YOUR/WEBHOOK/URL'
        channel: '#alerts'
        title: 'LogChef Alert: {{ .GroupLabels.alertname }}'

```

--------------------------------

### LogchefQL Example: Filtering HTTP Status Codes

Source: https://logchef.app/guide/search-syntax

Illustrates how to use comparison operators to filter logs based on HTTP status codes, categorizing server errors, client errors, and successful requests.

```LogchefQL
# Server errors
status>=500
```

```LogchefQL
# Client errors
status>=400 and status<500
```

```LogchefQL
# Successful requests
status=200
```

--------------------------------

### Override Admin Emails via Environment Variable

Source: https://logchef.app/getting-started/configuration

This example demonstrates setting admin email addresses using an environment variable. For array-based settings like admin emails, values are provided as a comma-separated string. This allows dynamic configuration of administrative access.

```bash
export LOGCHEF_AUTH__ADMIN_EMAILS="admin@example.com,ops@example.com"

```

--------------------------------

### Monitor HTTP Performance

Source: https://logchef.app/operations/metrics

These examples illustrate how to monitor HTTP endpoint performance by calculating the 95th percentile latency and the error rate per endpoint.

```PromQL
# Slowest endpoints (95th percentile)
histogram_quantile(0.95, rate(logchef_http_request_duration_seconds_bucket[5m]))


# Error rate by endpoint
rate(logchef_http_errors_total[5m]) / rate(logchef_http_requests_total[5m])
```

--------------------------------

### Override Server Port via Environment Variable

Source: https://logchef.app/getting-started/configuration

This example demonstrates how to override the server port configuration using an environment variable. Environment variables are prefixed with `LOGCHEF_` and use double underscores (`__`) for nested keys, providing a flexible way to manage configurations, especially in containerized environments.

```bash
export LOGCHEF_SERVER__PORT=8125

```

--------------------------------

### Basic Column Selection with Pipe Operator (LogchefQL and SQL)

Source: https://logchef.app/guide/examples

Shows how to use the pipe operator (`|`) to select specific columns instead of retrieving all fields (`SELECT *`). This example filters for errors and selects timestamp, service, level, and message.

```LogchefQL
level="error" | timestamp service level message
```

```SQL
SELECT timestamp, service, level, message
FROM logs.app
WHERE level = 'error'
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Custom Alert Annotations Example

Source: https://logchef.app/features/alerting

This JSON object shows examples of custom annotations that can be added to alerts to provide additional context, such as links to runbooks, dashboards, or troubleshooting playbooks.

```json
{
  "runbook": "https://wiki.example.com/runbooks/high-error-rate",
  "dashboard": "https://grafana.example.com/d/logs-overview",
  "playbook": "Check database connection pool and recent deployments"
}

```

--------------------------------

### Query Map Column by User ID (LogchefQL and SQL)

Source: https://logchef.app/guide/examples

Demonstrates how to query logs by attributes stored in Map columns, using dot notation for nested fields. This example filters by user ID within log attributes.

```LogchefQL
log_attributes.user_id="user-12345"
```

```SQL
SELECT *
FROM logs.app
WHERE log_attributes['user_id'] = 'user-12345'
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Request Latency Analysis (LogchefQL)

Source: https://logchef.app/guide/examples

Queries logs based on different response time ranges to analyze request latency. This includes examples for very slow, fast, and specific latency ranges.

```LogchefQL
# Very slow requests (over 5 seconds)
response_time>5000


# Fast requests (under 100ms)
response_time<100


# Requests in a specific range
response_time>=100 and response_time<=500
```

--------------------------------

### Alertmanager Basic Authentication Example

Source: https://logchef.app/features/alerting

This example provides a concrete URL for an Alertmanager requiring basic authentication. It includes a username 'admin', a password 'secretpass', and specifies the host 'alertmanager.internal' with port 9093.

```plaintext
# Basic authentication
https://admin:secretpass@alertmanager.internal:9093
```

--------------------------------

### Start LogChef MCP Server in STDIO Mode

Source: https://logchef.app/integration/mcp-server

Command to start the LogChef MCP server in STDIO mode, which is the default transport mode for direct integration with AI assistants.

```bash
logchef-mcp -t stdio
```

--------------------------------

### Query Multi-level Nested Fields (LogchefQL and SQL)

Source: https://logchef.app/guide/examples

Shows how to access deeply nested fields within Map or JSON columns using chained dot notation. Examples include querying HTTP request methods and error codes.

```LogchefQL
# Query nested request attributes
log_attributes.http.request.method="POST"


# Query nested error details
log_attributes.error.code="CONNECTION_REFUSED"
```

```SQL
SELECT *
FROM logs.app
WHERE log_attributes['http.request.method'] = 'POST'
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Identify Disk Space Warnings

Source: https://logchef.app/guide/examples

Detects servers running low on disk space by filtering system metrics where the free disk percentage is less than 15%. This allows for proactive maintenance.

```LogchefQL
type="system_metrics" and disk_free_percent<15
```

```SQL
SELECT *
FROM logs.app
WHERE type = 'system_metrics'
  AND disk_free_percent < 15
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### LogchefQL to ClickHouse SQL Conversion (Basic)

Source: https://logchef.app/guide/search-syntax

Illustrates how a typical LogchefQL query is translated into an optimized ClickHouse SQL query, including default time range and ordering.

```LogchefQL
level="error" and log_attributes.user_id="12345"
```

```SQL
SELECT *
FROM logs.app
WHERE (`level` = 'error') AND (`log_attributes`['user_id'] = '12345')
  AND timestamp BETWEEN toDateTime('2025-04-07 14:20:42', 'UTC') AND toDateTime('2025-04-07 14:25:42', 'UTC')
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Configure Alerting Settings in TOML

Source: https://logchef.app/getting-started/configuration

This snippet shows how to configure alerting settings in the `config.toml` file. These settings control real-time log monitoring and Alertmanager integration. This is an optional configuration that is only applied on the first boot.

```toml
[alerts]
enabled = false
evaluation_interval = "1m"
default_lookback = "5m"
history_limit = 50
alertmanager_url = ""
external_url = ""
frontend_url = ""
request_timeout = "5s"
tls_insecure_skip_verify = false

```

--------------------------------

### TOML Database Configuration for LogChef

Source: https://logchef.app/getting-started/configuration

Specifies the path to the SQLite database file used by LogChef for storing metadata. This is a required bootstrap setting.

```toml
[sqlite]
# Path to the SQLite database file
path = "logchef.db"

```

--------------------------------

### TOML Logging Configuration for LogChef

Source: https://logchef.app/getting-started/configuration

Configures the application logging level for LogChef. Supported levels include debug, info, warn, and error. Defaults to 'info'.

```toml
[logging]
# Log level: "debug", "info", "warn", "error"
level = "info"

```

--------------------------------

### TOML Server Configuration for LogChef

Source: https://logchef.app/getting-started/configuration

Configures the HTTP server and frontend settings for LogChef. Includes port, host binding, frontend URL, and HTTP server timeout. Defaults are provided for convenience.

```toml
[server]
# Port for the HTTP server (default: 8125)
port = 8125


# Host address to bind to (default: "0.0.0.0")
host = "0.0.0.0"


# URL of the frontend application
# Leave empty in production, used only in development
frontend_url = ""


# HTTP server timeout for requests (default: 30s)
http_server_timeout = "30s"

```

--------------------------------

### Custom Alert Labels Example

Source: https://logchef.app/features/alerting

This JSON object demonstrates how to define custom labels for alerts, which can be used for categorization and routing purposes within Alertmanager.

```json
{
  "env": "production",
  "service": "payment-api",
  "region": "us-east-1",
  "component": "database"
}

```

--------------------------------

### TOML OpenID Connect (OIDC) Authentication Configuration

Source: https://logchef.app/getting-started/configuration

Sets up OpenID Connect authentication for LogChef, requiring details like provider URL, client credentials, and redirect URL. Essential for SSO integration.

```toml
[oidc]
# URL of your OIDC provider
provider_url = "http://dex:5556/dex"


# Authentication endpoint URL (Optional: often discovered via provider_url)
auth_url = "http://dex:5556/dex/auth"


# Token endpoint URL (Optional: often discovered via provider_url)
token_url = "http://dex:5556/dex/token"


# OIDC client credentials
client_id = "logchef"
client_secret = "logchef-secret"


# Callback URL for OIDC authentication
# Must match the URL configured in your OIDC provider
redirect_url = "http://localhost:8125/api/v1/auth/callback"


# Required OIDC scopes
scopes = ["openid", "email", "profile"]

```

--------------------------------

### Basic Key-Value Search Syntax

Source: https://logchef.app/guide/search-syntax

The fundamental building block of LogchefQL uses a simple key-value pattern for filtering logs. This is the most basic way to specify search criteria.

```LogchefQL
key="value"
```

```LogchefQL
level="error"
service="payment-api"
```

--------------------------------

### Slow API Requests (LogchefQL and SQL)

Source: https://logchef.app/guide/examples

Identifies API requests that exceed a response time threshold (e.g., 1000ms), indicating potential performance bottlenecks. It filters based on request path and response time.

```LogchefQL
request_path~"/api/" and response_time>1000
```

```SQL
SELECT *
FROM logs.app
WHERE positionCaseInsensitive(request_path, '/api/') > 0
  AND response_time > 1000
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Run LogChef Binary with Configuration

Source: https://logchef.app/index

This snippet demonstrates how to run the LogChef binary directly. It involves downloading the executable, creating a configuration file (`config.toml`) to specify server address and ClickHouse DSN, and then launching LogChef with the configuration.

```bash
# Download the binary
curl -LO https://github.com/mr-karan/logchef/releases/latest/download/logchef_linux_amd64

# Create config
cat > config.toml << EOF
[server]
address = "0.0.0.0:8125"

[clickhouse]
ds"n" = "clickhouse://localhost:9000"
EOF

# Run
./logchef_linux_amd64 --config config.toml

```

--------------------------------

### LogchefQL Example: Service-Specific Error Logs

Source: https://logchef.app/guide/search-syntax

Combines filtering by service name and log level to pinpoint errors originating from a particular service.

```LogchefQL
service="payment-api" and level="error"
```

--------------------------------

### Build LogChef MCP Server from Source

Source: https://logchef.app/integration/mcp-server

Instructions for building the LogChef MCP server binary from its source code using Go. This involves cloning the repository and running the go build command.

```bash
git clone https://github.com/mr-karan/logchef-mcp.git
cd logchef-mcp
go build -o logchef-mcp ./cmd/logchef-mcp
```

--------------------------------

### Detect Failed Authentication Attempts

Source: https://logchef.app/guide/examples

Identifies potential brute-force attacks by filtering logs for failed login events and IP addresses starting with '192.168.'. The SQL equivalent demonstrates how to achieve the same using `positionCaseInsensitive` for substring matching.

```LogchefQL
event="login_failed" and ip_address~"192.168."
```

```SQL
SELECT *
FROM logs.app
WHERE event = 'login_failed'
  AND positionCaseInsensitive(ip_address, '192.168.') > 0
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Get Focused Trace View

Source: https://logchef.app/guide/examples

Retrieves a focused view of a trace by selecting only specific fields like timestamp, service name, span ID, and body, using a given trace ID. This reduces data noise for specific analysis.

```LogchefQL
trace_id="abc123def456" | timestamp service_name span_id body
```

--------------------------------

### Configure LogChef AI via Environment Variables

Source: https://logchef.app/features/ai-sql-generation

Set AI configuration parameters using environment variables for containerized deployments or CI/CD pipelines. These variables are used to seed the database on the first boot. Note that after the initial setup, the Admin Settings UI will take precedence.

```bash
export LOGCHEF_AI__ENABLED=true
export LOGCHEF_AI__API_KEY="sk-your_api_key_here"
export LOGCHEF_AI__MODEL="gpt-4o"
export LOGCHEF_AI__BASE_URL="https://api.openai.com/v1"
```

--------------------------------

### Generate SQL from Natural Language - Basic Query

Source: https://logchef.app/features/ai-sql-generation

Demonstrates generating a ClickHouse SQL query from a natural language prompt within the LogChef query editor. The AI assistant translates the user's request into executable SQL.

```sql
SELECT *
FROM logs_table
WHERE severity_text = 'ERROR'
  AND timestamp >= now() - INTERVAL 6 HOUR
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Override OIDC Provider URL via Environment Variable

Source: https://logchef.app/getting-started/configuration

This snippet shows how to set the OIDC provider URL using an environment variable. This is useful for configuring authentication providers, especially when running LogChef in a containerized setup where direct file modifications might be complex.

```bash
export LOGCHEF_OIDC__PROVIDER_URL="http://dex.example.com/dex"

```

--------------------------------

### Enable AI Features and Set Model via Environment Variables

Source: https://logchef.app/getting-started/configuration

This snippet demonstrates enabling AI features and specifying the AI model using environment variables. This approach allows for dynamic control over AI functionality, making it easy to toggle features and select models without modifying configuration files directly.

```bash
export LOGCHEF_AI__ENABLED=true
export LOGCHEF_AI__MODEL="gpt-4o"

```

--------------------------------

### Deploy LogChef using Docker Compose

Source: https://logchef.app/index

This snippet shows how to deploy LogChef using Docker Compose. It involves downloading a docker-compose.yml file and running it with `docker compose up -d`. Access LogChef at http://localhost:8125 after deployment.

```bash
# Start LogChef with ClickHouse
curl -LO https://raw.githubusercontent.com/mr-karan/logchef/main/deployment/docker/docker-compose.yml

docker compose up -d

# Open http://localhost:8125

```

--------------------------------

### Minimal Production Configuration in TOML

Source: https://logchef.app/getting-started/configuration

This TOML snippet outlines the essential configuration for a minimal production deployment of LogChef. It includes settings for the server, SQLite database, OIDC authentication, administrative access, and logging level. Other settings can be managed via the Admin Settings UI.

```toml
[server]
port = 8125
host = "0.0.0.0"
http_server_timeout = "30s"


[sqlite]
path = "/data/logchef.db"


[oidc]
provider_url = "https://dex.example.com"
client_id = "logchef"
client_secret = "your-secure-secret"
redirect_url = "https://logchef.example.com/api/v1/auth/callback"
scopes = ["openid", "email", "profile"]


[auth]
admin_emails = ["admin@example.com"]
api_token_secret = "your-secret-key-minimum-32-characters-long"


[logging]
level = "info"

```

--------------------------------

### Pattern Matching in Nested Fields (LogchefQL and SQL)

Source: https://logchef.app/guide/examples

Illustrates using the 'contains' operator (`~`) on nested field values within Map or JSON columns. This example filters URLs containing '/api/v2/'.

```LogchefQL
log_attributes.request.url~"/api/v2/"
```

```SQL
SELECT *
FROM logs.app
WHERE positionCaseInsensitive(log_attributes['request.url'], '/api/v2/') > 0
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### TOML AI SQL Generation Configuration for LogChef

Source: https://logchef.app/getting-started/configuration

Provides optional initial settings for AI-powered SQL generation in LogChef. These settings can be overridden via the Admin Settings UI after the first boot. Includes options for enabling AI, base URL, API key, model, max tokens, and temperature.

```toml
[ai]
enabled = false
base_url = "https://api.openai.com/v1"
api_key = ""  # Set via Admin UI after first boot
model = "gpt-4o"
max_tokens = 1024
temperature = 0.1

```

--------------------------------

### Enhance SQL with Context-Aware AI Suggestions

Source: https://logchef.app/features/ai-sql-generation

Shows how the LogChef AI assistant can consider an existing query in the editor to enhance it based on new natural language input. This allows for iterative query refinement.

```sql
SELECT *
FROM logs
WHERE service = 'api-gateway'
  AND severity_text = 'ERROR'
  AND timestamp >= now() - INTERVAL 1 HOUR
ORDER BY timestamp DESC
```

--------------------------------

### JSON Column Extraction (LogchefQL and SQL)

Source: https://logchef.app/guide/examples

Explains how to extract data from JSON or String columns containing JSON using `JSONExtractString`. This example filters based on the user agent string within the 'body' field.

```LogchefQL
body.request.user_agent~"Mozilla"
```

```SQL
SELECT *
FROM logs.app
WHERE positionCaseInsensitive(JSONExtractString(body, 'request', 'user_agent'), 'Mozilla') > 0
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Initial Alert Configuration (config.toml)

Source: https://logchef.app/features/alerting

This TOML snippet shows the initial configuration for alerts in LogChef, intended for the first boot. It enables alert evaluation, sets the evaluation interval, default lookback window, history limit, Alertmanager URL, external and frontend URLs, request timeout, and TLS verification setting. After the first boot, these settings are managed via the Admin Settings UI.

```toml
[alerts]
# Enable alert evaluation and delivery
enabled = true


# How often to evaluate all alerts (default: 1 minute)
evaluation_interval = "1m"


# Default lookback window if not specified in alert (default: 5 minutes)
default_lookback = "5m"


# Maximum alert history entries to keep per alert (default: 100)
history_limit = 100


# Alertmanager API endpoint
alertmanager_url = "http://alertmanager:9093"


# Backend URL for API access (used for fallback)
external_url = "http://localhost:8125"


# Frontend URL for web UI generator links
frontend_url = "http://localhost:5173"


# HTTP request timeout for Alertmanager communication
request_timeout = "5s"


# Skip TLS certificate verification (for development only)
tls_insecure_skip_verify = false

```

--------------------------------

### LogchefQL Equality Operators

Source: https://logchef.app/guide/search-syntax

These operators allow for exact matching of values in log fields. They are crucial for precise filtering.

```LogchefQL
status=200
```

```LogchefQL
level!="debug"
```

--------------------------------

### LogchefQL Comparison Operators

Source: https://logchef.app/guide/search-syntax

These operators enable numerical comparisons on log fields, useful for filtering based on ranges or thresholds.

```LogchefQL
status>400
```

```LogchefQL
response_time<1000
```

```LogchefQL
severity_number>=3
```

```LogchefQL
duration<=5000
```

--------------------------------

### Alertmanager Basic Authentication URL Format

Source: https://logchef.app/features/alerting

This example demonstrates the format for including username and password for HTTP Basic Authentication when configuring the Alertmanager URL. It shows how to prepend credentials to the Alertmanager's host and port.

```plaintext
https://username:password@alertmanager.example.com
```

--------------------------------

### Find All Errors (LogchefQL and SQL)

Source: https://logchef.app/guide/examples

Retrieves all log entries with a level of 'error' to provide an overview of system health. This is a basic filtering operation on the log level.

```LogchefQL
level="error"
```

```SQL
SELECT *
FROM logs.app
WHERE level = 'error'
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Find Service-Specific Errors (LogchefQL and SQL)

Source: https://logchef.app/guide/examples

Filters logs to find errors originating from a specific service, useful for targeted troubleshooting. It combines level and service filtering.

```LogchefQL
level="error" and service="payment-api"
```

```SQL
SELECT *
FROM logs.app
WHERE level = 'error'
  AND service = 'payment-api'
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### LogchefQL to ClickHouse SQL Conversion (Pipe Operator)

Source: https://logchef.app/guide/search-syntax

Shows the ClickHouse SQL generated from a LogchefQL query that utilizes the pipe operator for selecting specific columns.

```LogchefQL
level="error" | timestamp level body
```

```SQL
SELECT `timestamp`, `level`, `body`
FROM logs.app
WHERE `level` = 'error'
  AND timestamp BETWEEN toDateTime('2025-04-07 14:20:42', 'UTC') AND toDateTime('2025-04-07 14:25:42', 'UTC')
ORDER BY timestamp DESC
LIMIT 100
```

--------------------------------

### Configure LogChef MCP Server in Claude Desktop (Binary)

Source: https://logchef.app/integration/mcp-server

Configuration for Claude Desktop to use the LogChef MCP server when running as a binary. It specifies the command and environment variables required for the integration.

```json
{
  "mcpServers": {
    "logchef": {
      "command": "logchef-mcp",
      "args": [],
      "env": {
        "LOGCHEF_URL": "http://localhost:8125",
        "LOGCHEF_API_KEY": "<your_api_token>"
      }
    }
  }
}
```
Tokens:
Raw