DEV Community

John Ajera
John Ajera

Posted on

Using GoAccess to View nginx Logs

#goaccess #nginx #logs #aws

Using GoAccess to View nginx Logs

GoAccess is a fast terminal and HTML log analyzer for nginx access logs (requests/sec, status codes, top URLs, referrers, user agents). This guide covers installation, optional S3 download, and typical run modes.

1. Overview

  • Install GoAccess (package manager, source, or jdevto/cli-tools script)
  • Optional: sync logs from S3 when they are not on the machine you analyze from
  • Run TUI, HTML report, live tail, or compressed input; use COMBINED or COMMON to match nginx log_format

Skip §4 if logs are already on disk.

2. Prerequisites

  • Readable nginx access logs (usually combined or common format)
  • sudo for distro package installs
  • S3 (optional): AWS CLI v2 and s3:GetObject / s3:ListBucket for the prefix you use

3. Install GoAccess

Fedora / RHEL / CentOS Stream 

sudo dnf install -y goaccess
Enter fullscreen mode Exit fullscreen mode

Debian / Ubuntu 

sudo apt update && sudo apt install -y goaccess
Enter fullscreen mode Exit fullscreen mode 
goaccess --version
Enter fullscreen mode Exit fullscreen mode

Newer or custom build: official build instructions.

jdevto/cli-tools installer (optional)

Builds from the official tarball; details and env vars in install_goaccess.md.

bash <(curl -s https://raw.githubusercontent.com/jdevto/cli-tools/main/scripts/install_goaccess.sh) install
Enter fullscreen mode Exit fullscreen mode 
bash <(curl -s https://raw.githubusercontent.com/jdevto/cli-tools/main/scripts/install_goaccess.sh) uninstall
Enter fullscreen mode Exit fullscreen mode

4. Optional: Download nginx Logs from S3

Single file 

mkdir -p ~/nginx-logs
aws s3 cp s3://my-bucket/path/to/access.log ~/nginx-logs/access.log
Enter fullscreen mode Exit fullscreen mode

Key is .gz only: download, decompress, or stream without extracting:

aws s3 cp s3://my-bucket/path/to/access.log.gz ~/nginx-logs/access.log.gz
gzip -d ~/nginx-logs/access.log.gz
# or: zcat ~/nginx-logs/access.log.gz | goaccess - --log-format=COMBINED
Enter fullscreen mode Exit fullscreen mode

Prefix (many files) 

mkdir -p ~/nginx-logs
aws s3 sync s3://my-bucket/nginx-logs/ ~/nginx-logs/
Enter fullscreen mode Exit fullscreen mode

Replace bucket and prefix. If you only have *.gz, after sync use zcat ~/nginx-logs/*.gz > ~/nginx-logs/merged-access.log (order across files may not be chronological) or decompress then merge plain *.log.

Merge plain logs (optional) 

cat ~/nginx-logs/*.log > ~/nginx-logs/merged-access.log
Enter fullscreen mode Exit fullscreen mode

5. Run GoAccess

Match --log-format to nginx (COMBINED is the usual default).

Terminal UI 

goaccess /var/log/nginx/access.log --log-format=COMBINED
Enter fullscreen mode Exit fullscreen mode

HTML report 

goaccess /var/log/nginx/access.log --log-format=COMBINED -o report.html --no-parsing-spinner
xdg-open report.html
Enter fullscreen mode Exit fullscreen mode

Live log 

tail -f /var/log/nginx/access.log | goaccess - --log-format=COMBINED
Enter fullscreen mode Exit fullscreen mode

Common log format 

goaccess /var/log/nginx/access.log --log-format=COMMON
Enter fullscreen mode Exit fullscreen mode

Custom log_format: map fields with GoAccess custom format tokens.

Compressed on disk 

zcat /var/log/nginx/access.log.*.gz | goaccess - --log-format=COMBINED
Enter fullscreen mode Exit fullscreen mode

6. Summary: Copy-Paste 

sudo dnf install -y goaccess
mkdir -p ~/nginx-logs && aws s3 sync s3://YOUR_BUCKET/YOUR_PREFIX/ ~/nginx-logs/   # optional
goaccess /var/log/nginx/access.log --log-format=COMBINED
goaccess /var/log/nginx/access.log --log-format=COMBINED -o report.html --no-parsing-spinner && xdg-open report.html
tail -f /var/log/nginx/access.log | goaccess - --log-format=COMBINED
Enter fullscreen mode Exit fullscreen mode

7. Troubleshooting

Parsed 0 lines / wrong numbers: Log line shape ≠ COMBINED/COMMON. Compare head -1 to nginx log_format and adjust --log-format.

Permission denied on log: sudo goaccess ..., fix group on log files, or copy the log to your home directory.

S3 Access Denied: IAM on bucket/prefix; check AWS_PROFILE / role.

Live tail idle: Confirm nginx access_log path and read permissions on the active file.

8. References

Top comments (0)