Kubernetes / CRI
CRI-O-style timestamps, stdout/stderr streams and embedded JSON messages. Pipe kubectl logs into Flik.
grep → egrep → awk → jq → tailAnother condition. Another pipe. Another run.
FLIK / INTERACTIVE TERMINAL LOG ANALYZER
Interactive terminal
log analysis.
Stop rebuilding the same log pipeline. Open your logs and make Kubernetes JSON readable. Stack filters until you find the failure. Press x to step back and keep investigating.
Kubernetes / CRI · Nginx · Apache · JSON / NDJSON
Local files & live streams · macOS & Linux · MIT licensed
KUBERNETES JSON → STACKED FILTERS → UNDO
Actual Flik recording. Synthetic logs. Every key press changes the real interface.
REPEATABLE INVESTIGATION
Five requests.
Two failures. One answer.
The synthetic Nginx sample contains one 502 and one 503 among five requests. Filter status:5xx, press H, and the 10:00 UTC bucket contains exactly two matching requests.
Synthetic data, not a throughput benchmark. Frequency reports scan the full indexed source; the S dashboard uses a sample of up to 5,000 lines.
SUPPORTED LOG FORMATS
Built for the logs you investigate.
Automatic format detection, structured fields and a raw-text fallback.
Nginx
Common / Combined access logs and Nginx error logs. Inspect requests, HTTP status codes and error severity.
JSON / NDJSON
Discover fields, select columns, filter values and inspect nested objects. Open application logs directly.
Apache, Syslog & text
Apache access and error formats, traditional Syslog and plain-text logs with search and context.
Custom access-log layouts may use raw-text mode. Timestamp reports include lines with recognized timestamps; missing timestamps are reported separately.
INVESTIGATION FEATURES
From a matching line
to an explainable incident.
Keep the filters, surrounding events and measurements in one keyboard-driven workspace.
Narrow the event stream.
Stack include/exclude rules, use regular expressions and combine conditions with AND, OR and NOT. Complete fields and observed values.
(level:error OR status>=500) AND service:paymentRead the fields that matter.
Switch between lines and columns. Select JSON fields, inspect distinct values and frequencies, and filter from a selected value.
flik --table --fields timestamp,level,message app.jsonlKeep the surrounding events.
Smart find includes preceding and following lines. Context stays in file order, without duplicates, and is visually distinguished from matches.
//3,2:errorMeasure what the log contains.
HTTP status codes for access logs. ERROR, NOTICE and other detected levels for error logs. Inspect frequent IPs, endpoints and errors.
S → select a value → EnterFind when errors recur.
Count the active filter by minute, hour or day. Compare two equal time windows or two files to identify new and disappearing patterns.
histogram hour · compare filesFollow requests across files.
Open two independent panes, merge matching events chronologically and filter by a correlation ID. Save sessions and export incident context.
trace req-demo-42Analysis scope is visible.The S dashboard samples up to 5,000 lines. Frequency and comparison reports scan the full indexed source in the background. Context-only lines are excluded from occurrence counts. Times are shown in UTC.
PRODUCT RECORDINGS
Watch the keys. See the result.
Real terminal sessions with typing, navigation and on-screen key prompts. Follow the actions, then try them on the sample logs.
FLIK / TERMINAL RECORDINGflik · Kubernetes JSONSYNTHETIC DATA
01
Read the JSON. Narrow the failure. Undo one step.
Press w to expand embedded Kubernetes JSON. Add service:payment, add level:error, then press x to remove only the last filter.
w → 3 → service:payment → 3 → level:error → xThe recording opens compact CRI logs, beautifies the embedded JSON, stacks two include rules and removes the newest one. The first rule stays active.
Download recording ↓SELF-HOSTED RECORDINGS · SYNTHETIC LOGS · ENGLISH CAPTIONS
PRACTICAL EXAMPLES
Start with a real task.
Shell commands open the data. Search queries run inside Flik. Investigation commands run in the Ctrl+K prompt.
YOUR EXISTING CLI WORKFLOW
An interactive alternative to repeated jq, grep and tail inspection.
Use Flik for log filtering, field selection, surrounding context and live following. Keep jq for JSON transformations and scripted data processing.
JSON / jqInspect selected fields and filter a service
Move repeated jq field selection and log filtering into an interactive table. Adjust the columns and filters without rerunning the pipeline.
jq '{timestamp, service, message}' app.jsonlflik --table --fields timestamp,service,message app.jsonl3 Add the include filter service:payment. Use 6 to change fields and v to inspect a field’s values.
Flik covers interactive JSON log inspection. Keep jq for JSON transformations, object construction and scripted pipelines; Flik does not execute jq expressions.
Download synthetic JSON logs ↓KUBERNETESInspect a live pod log stream
Pipe a Kubernetes log stream into Flik, then add filters and choose fields while new events arrive.
SHELLkubectl logs -f deployment/demo-api | flik -/ Search for timeout. Use Tab in the search prompt to complete fields and values, or w to expand embedded JSON when available.
Saved CRI-style log files are detected automatically. kubectl output is parsed according to the emitted application format.
Download a synthetic CRI log ↓NGINXInvestigate failed requests and server errors
SHELL — ACCESS LOG
flik access.log3 Apply status:5xx, then H for hourly counts. Use S for the HTTP status breakdown and frequent endpoints.
For an Nginx error log, open flik nginx-error.log. The statistics dashboard shows detected severity levels when no HTTP statuses are present.
ERROR CONTEXTSee what happened before an error
TYPE IN THE MAIN LOG VIEW, THEN ENTER
//3,2:errorShows each matching error, three preceding lines and two following lines. //error uses one preceding line. Context-only lines appear in gray.
Ctrl+G opens a larger context view around the selected result. Inside that view, n / p move between matches and Esc returns to the file.
Download synthetic events ↓FREQUENCYCount a filtered error over time
First filter the error with /timeout, then press H for hourly counts. For another interval, open Ctrl+K and enter:
histogram minuteAlso accepts histogram hour and histogram day. Counts use the active filters and exclude context-only lines. Results are UTC snapshots; close and rerun to refresh.
TRACES & CHANGEFollow a request or compare incident windows
SHELL — OPEN TWO FILES
flik api.log worker.logIn Ctrl+K, enter trace req-demo-42 to filter both sources and merge matching events chronologically. Existing filters remain active.
compare 2026-01-15T10:00:00Z 15Use a timestamp from your log. compare files compares the two open sources. Changes describe observed patterns, not a proven cause.
KEYBOARD REFERENCE
Keyboard first.
Undo included.
Shortcuts are case-sensitive and apply to the main log view unless noted. Press 1 or ? for the in-app guide.
Navigate & display
| Key | Action |
|---|---|
| ↑ / ↓ / k / j | Move through log lines |
| Space / f / PgDn | Page down |
| b / PgUp | Page up |
| g / Home | Go to the beginning |
| G / End | Go to the end / resume following |
| ← / → | Scroll horizontally |
| Tab / 4 / F4 | Switch line / column view |
| 5 / t / F5 | Toggle live follow (tail) |
| 6 / F6 | Choose visible fields |
| R | Select fields or a column range |
| w | Expand / collapse embedded JSON |
| I | Toggle newest-first order |
| c / n | Toggle colors / line numbers |
| T | Switch color theme |
| r | Reload the file |
Search & filter
| Key | Action |
|---|---|
| / / 7 / F7 | Open quick search |
//error | Smart find with the preceding line |
//3,2:error | Smart find with 3 before / 2 after |
| 3 / + / i / F3 | Add an include filter |
| 8 / - / e / F8 | Add an exclude filter |
| Ctrl+F | Manage stacked filter rules |
| x | Undo the last filter |
| X | Clear filters and restore fields |
| Tab in search | Complete fields / observed values |
| Ctrl+Space in a filter | Complete fields / observed values |
| Tab in a filter | Toggle include / exclude mode |
| F2 / Ctrl+R in a filter | Toggle regular expression mode |
| F3 / Ctrl+C in a filter | Toggle case-sensitive matching |
| Enter / Esc in prompts | Apply / cancel |
Analyze & investigate
| Key | Action |
|---|---|
| S / s | Statistics dashboard |
| H | Filtered occurrences per hour |
| P / p | Group similar log patterns |
| v | Inspect distinct field values |
| Ctrl+G | Context around the selected event |
| Ctrl+T | Enter a time range |
| Ctrl+L | Merge matching events from both files |
| C | Discover identifiers on a line |
| Ctrl+R | Trace an identifier across files |
| D / d | Select two lines for comparison |
| B | Toggle bookmark on the current line |
| ' | Jump to the next bookmark |
| Ctrl+K | Open investigation commands |
Files, sessions & exports
| Key | Action |
|---|---|
| Ctrl+O | Open a file in the active pane |
| Ctrl+N | Open a file in the other pane |
| Ctrl+← / Ctrl+→ | Focus the left / right pane |
| F12 / Ctrl+] | Switch panes |
| Ctrl+W | Close the active pane |
| Ctrl+P | Save the workspace session |
| Ctrl+S | Export raw lines, JSON Lines or CSV |
| Ctrl+E | Export incident context with redaction |
| y | Copy the selected line |
| M | Toggle terminal mouse capture |
| 2 / o / F2 | Detect the log format again |
| 1 / h / ? / F1 | Open the help guide |
| 9 / m / Esc / F9 | Open the menu |
| Q / q twice / F10 | Quit Flik |
Investigation commands Open with Ctrl+K
| Command | Purpose |
|---|---|
context 20 | Show 20 lines before and after the selected result |
time START..END / jump TIME | Filter a time range or jump to a timestamp (RFC3339) |
around 5 / untime | Window ±5 minutes around an event / remove the time filter |
histogram minute|hour|day | Count matching events over time |
compare TIME 15 / compare files | Compare equal time windows or the two open files |
merge / trace req-demo-42 | Merge the filtered chronology / follow a request |
save session.json / load session.json | Save or restore files, filters, fields and positions |
redact email,customer_id | Add extra field names to the built-in redaction keys |
export incident.jsonl | Export events with sources, original lines and context |
Some terminals reserve Ctrl combinations; menu entries and function keys provide alternatives. Redaction is based on known keys and patterns; review incident exports before sharing.
PRACTICAL GUIDES
Find the answer.
Keep the evidence.
Complete investigations with sample logs, exact key sequences and expected results.
Filter Kubernetes JSON logs interactively
Make container JSON readable, stack service and error filters, then undo one condition while your investigation stays open.
Find an error and the log lines before it
Use smart find to keep the events surrounding an error, refine the result and return to the original file order.
Count Nginx errors per hour
Filter failed Nginx requests, count occurrences by hour and distinguish HTTP statuses from error-log severity.
Flik, grep and jq: choose the right log workflow
Compare interactive log investigation with shell filtering and JSON transformation, using the same small example.
INSTALLATION
Download Flik.
GitHub releases provide ready-to-run archives for macOS and Linux. No Rust installation is needed to use Flik. Browse published GitHub releases →
Ready-to-run releases for macOS and LinuxSource on GitHub↗CHOOSE YOUR PLATFORMRELEASES
Binary available with the first releasemacOS · Apple Silicon · .tar.gz
SHA256SUMS ↗AFTER DOWNLOADING
tar -xzf flik-vVERSION-aarch64-apple-darwin.tar.gz
./flik demo.logEach release includes SHA-256 checksums to verify your downloads.
What about automatic installation?
The installation script will be available with the first public release.
macOS: binaries are currently unsigned. Windows: no native binary announced. Files and streams stay local.