DEV Community

Sulthon Zainul Habib
Sulthon Zainul Habib

Posted on • Originally published at github.com

I Replaced 70MB Node.js Log Viewer with a 172KB Zig Binary

#zig #performance #cli #devtools

Log files are the debugging reality of production systems. You stare at them daily, curse the noise, and grep until your eyes bleed.

The problem? Most log viewers are heavy, slow, or require complex setups. I wanted something that just works.

The Problem

I tried the usual suspects:

  • tail -f: Raw, unfiltered stream. No filtering, no highlighting. Useless for anything beyond watching errors fly by.
  • grep: Powerful but terminal-destroying. grep -R "ERROR" ./logs | grep "database" works, but it's not interactive. You can't drill down, and the output is a wall of text.
  • Docker logs: docker logs -f container is okay for one container, but when you have 15 microservices, it's a mess.
  • Existing log viewers: Most are GUI apps (heavy), or Node.js CLI tools (slow, 70MB+ dependencies), or require configuration files.

I needed something that:

  1. Is fast — no lag when scrolling through 1GB log files
  2. Has syntax highlighting — ERROR in red, DEBUG in gray, stack traces visible
  3. Lets me filter interactively — type / to search, drill down without re-running commands
  4. Is tiny — no 70MB node_modules bloat

The Solution: logchef-zig

I wrote logchef-zig in Zig. It's a single 172KB binary that does exactly what I need:

What It Does 

# View any log file with auto-highlighting
logchef app.log

# Follow mode (like tail -f, but with filtering)
logchef -f app.log

# Filter by log level before opening
logchef --level error app.log

# Interactive search (press / inside the viewer)
logchef app.log
Enter fullscreen mode Exit fullscreen mode

Why Zig?

I chose Zig for three reasons:

  1. Zero dependencies: No node_modules, no Python runtime, nothing. Just one binary.
  2. Performance: Zig compiles to native machine code. I'm talking instant scrolling on 1GB+ files.
  3. Cross-compilation: I can build for Linux, macOS, and Windows from my Mac. One CI run, three binaries.

How It Works

1. Fast Log Parsing

Logchef reads logs line-by-line and detects common log formats automatically:

2026-05-25T02:19:12.123Z [INFO] User logged in
2026-05-25T02:19:15.456Z [ERROR] Database connection failed
Enter fullscreen mode Exit fullscreen mode

It extracts timestamps, log levels, and context, then applies syntax highlighting.

2. Interactive TUI

The interface is terminal-based (like htop or lazygit):

  • Arrow keys: Scroll through the file
  • /: Search for patterns (supports regex)
  • l: Filter by log level (DEBUG, INFO, WARN, ERROR)
  • q: Quit

No mouse required. Pure keyboard efficiency.

3. Zero Configuration

Logchef doesn't need a config file. It detects log patterns heuristically. If your logs look like this:

[INFO] Something happened
ERROR: Something broke
Enter fullscreen mode Exit fullscreen mode

It just works. If they don't, you can pass a custom regex.

Benchmarks

I tested logchef against a 1GB log file with 10 million lines:

Tool Startup Time Memory Usage Binary Size
logchef-zig 0.05s 2.5MB 172KB
Node.js equivalent 1.2s 85MB 70MB
bat (syntax highlighter) 0.8s 12MB 4.2MB
cat (no highlighting) 0.01s 0.5MB N/A

Scrolling is instant. No lag. No beach balls.

Real-World Use Cases

Debugging Production Issues

You get paged at 2 AM. A service is failing.

# SSH into the server
ssh production-server

# Start following the logs
logchef -f /var/log/app/app.log

# Press `/` and type "ERROR" to filter only errors
# Press `l` to switch to error-only view
# Use arrow keys to scroll through the error context
Enter fullscreen mode Exit fullscreen mode

You find the root cause in 30 seconds instead of 10 minutes.

Local Development

You're running a dev server and want to see errors only:

# Run your server in background
npm run dev &

# Follow logs, error-only
logchef -f --level error logs/combined.log
Enter fullscreen mode Exit fullscreen mode

CI/CD Debugging

Your CI pipeline failed. You download the log artifact:

# CI artifact downloaded to build.log
logchef build.log

# Search for the first error
/ ERROR

# Jump to that line, scroll to see context
Enter fullscreen mode Exit fullscreen mode

Getting Started

Installation

macOS / Linux (Homebrew):

brew install sulthonzh/tap/logchef
Enter fullscreen mode Exit fullscreen mode

Manual download:

# Download from GitHub Releases
wget https://github.com/sulthonzh/logchef-zig/releases/latest/download/logchef-macos-arm64
chmod +x logchef-macos-arm64
mv logchef-macos-arm64 /usr/local/bin/logchef
Enter fullscreen mode Exit fullscreen mode

From source:

# Requires Zig 0.13+
git clone https://github.com/sulthonzh/logchef-zig.git
cd logchef-zig
zig build -Doptimize=ReleaseSafe
zig build install
Enter fullscreen mode Exit fullscreen mode

Basic Usage 

# View a log file
logchef app.log

# Follow mode (live updates)
logchef -f app.log

# Filter by log level
logchef --level error app.log
logchef --level debug app.log

# Search inside the viewer (press /)
logchef app.log
# Press /, type pattern, enter
# Use n/N for next/previous match
Enter fullscreen mode Exit fullscreen mode

What's Next

I'm planning:

  • Custom log format parsing (via CLI flags)
  • Log aggregation (multiple files at once)
  • Time-range filtering (logchef --from "2h ago" --to "now" app.log)

But even in its current form, logchef-zig has replaced grep and tail for me.

Links

Built with Zig. No dependencies. Just logs.

Top comments (0)