honeytail is Honeycomb's agent for ingesting log file data into Honeycomb and making it available for exploration. Its favorite format is JSON, but understands how to parse a range of other well-known log formats.

See our documentation to read about how to configure and run honeytail, to find tips and best practices, and to download prebuilt versions.

honeytail supports reading files from STDIN as well as from a file on disk.

Our complete list of parsers can be found in the parsers/ directory, but as of this writing, honeytail will support parsing logs generated by:

• ArangoDB
• MongoDB
• MySQL
• PostgreSQL (Note: does not support quoted table or column names in queries.)
• nginx
• regex
• keyval(logfmt)
• csv
• syslog

Install from source:

go install github.com/honeycombio/honeytail@latest

to install to a specific path:

GOPATH=/usr/local go install github.com/honeycombio/honeytail@latest

the binary will install to /usr/local/bin/honeytail

Use a prebuilt binary: find the latest version on Honeycomb.io

Using command line arguments:

honeytail --writekey=YOUR_WRITE_KEY --dataset='Best Data Ever' --parser=json --file=/var/log/api_server.log

Using a config file:

honeytail --config honeytail-conf.ini

For more advanced usage, options, and the ability to scrub or drop specific fields, see our documentation.

We've extracted out some generic work for a particular log format:

• mysqltools contains logic specific to normalizing MySQL queries

Features, bug fixes and other changes to honeytail are gladly accepted. Please open issues or a pull request with your change. Remember to add your name to the CONTRIBUTORS file!

All contributions will be released under the Apache License 2.0.