Rust-a-Log: filter recent errors in a large log, then keep watching

I maintain Rust-a-Log, a command-line log viewer written in Rust. It reads recent records, filters them, and follows new writes.

Updated October 15, 2026: version 0.1.1 is on crates.io. It also adds stdin streaming, command capture, a TUI, and authenticated LAN streams. This article focuses on the file reader.

The useful detail is where the line count applies. If you ask for the last 20 errors or warnings, it finds 20 matching records, rather than taking the last 20 lines and discarding everything else.

Try the published version

With a compatible Rust toolchain installed:

cargo install rust-a-log --version 0.1.1 --locked
rual app.log -e -w -n 20

This shows the last 20 errors or warnings and follows new records. Press Ctrl+C to stop. Native Windows, Linux, and macOS binaries are available on the release page.

For a one-time search:

rual app.log -g timeout --ignore-case --once

You can combine the two:

rual app.log -e -g database -n 5 --once

This prints the last five error records that also contain database. The text filter is literal, not a regular expression.

Why scan backwards?

When you only need recent records, reading the entire file first does unnecessary work. Rust-a-Log scans backwards in 64 KiB blocks until it finds enough matching records. Its memory use depends on the longest record and a small buffer, rather than the total file size.

A rare filter can still require scanning the whole file. There is no search index or cache.

A few limits to know

• File mode needs a regular, seekable text file. Use rual - for stdin. Compressed logs and multiline grouping of plain text are not supported.
• Level filters recognize bracketed labels such as [ERROR], [WARN], and [INFO].
• Linux and macOS can reopen a renamed or replaced log. On Windows, rename rotation requires restarting the viewer.
• Following uses polling, so a file that is truncated and regrown between checks can lose records.

Capture an application without changing its logger

rual run --tui --name api -- node app.mjs

This captures stdout and stderr from the child command. Each record retains a stream field. It does not need an adapter or a socket receiver.

For an existing pipe:

docker logs --follow my-app 2>&1 | rual - -e

The README covers the full behavior, including the TUI and the six language adapters. The project is free and MIT-licensed.

Feedback with a reproducible log sample is useful, especially for filtering and rotation cases.

AI disclosure: this update was prepared with AI assistance from the public source and release documentation.