⚠️ ALPHA RELEASE: LogTide is currently in active Alpha. The Cloud version is 100% FREE for early adopters. We are looking for feedback to improve stability!
📢 Rebranded: LogTide was previously known as LogWard. We changed our name due to a trademark conflict. Read more about the rebrand.
LogTide is an open-source alternative to Datadog, Splunk, and ELK. Designed for developers and European SMBs who need GDPR compliance, data ownership, and simplicity without the complexity of managing an ElasticSearch cluster.
- 🇪🇺 GDPR Friendly: Keep data on your servers or use our EU-based cloud.
- ⚡ Lightweight: Built on TimescaleDB & Fastify (low RAM usage compared to Java stacks).
- 🚀 Developer Experience: 5-minute setup with Docker. Native SDKs.
- 💰 Cost Effective: Self-host for free.
Choose how you want to use LogTide.
We host it for you. Perfect for testing and small projects. Currently Free.
- Sign up: Go to logtide.dev.
- Create Project: Create an organization and a project.
- Get API Key: Copy your project-scoped API Key.
- Send a Log:
curl -X POST https://api.logtide.dev/api/v1/ingest \ -H "X-API-Key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "logs": [{ "service": "test", "level": "info", "message": "Hello Cloud!" }] }'
Total control over your data. No build required - uses pre-built images from Docker Hub.
Prerequisites: Docker & Docker Compose.
-
Download configuration
mkdir logtide && cd logtide curl -O https://raw.githubusercontent.com/logtide-dev/logtide/main/docker/docker-compose.yml curl -O https://raw.githubusercontent.com/logtide-dev/logtide/main/docker/.env.example mv .env.example .env
-
Edit
.envwith secure passwordsnano .env
Required variables:
DB_PASSWORD=your_secure_db_password REDIS_PASSWORD=your_secure_redis_password API_KEY_SECRET=your_32_character_secret_key_here
-
Start the stack
docker compose up -d
-
Access LogTide
- Frontend:
http://localhost:3000 - API:
http://localhost:8080 - First Time? Click "Sign up" to create your account
- Frontend:
Note: Database migrations run automatically on first start.
- (Optional) Enable Docker log collection with Fluent Bit
# Download Fluent Bit configuration files curl -O https://raw.githubusercontent.com/logtide-dev/logtide/main/docker/fluent-bit.conf curl -O https://raw.githubusercontent.com/logtide-dev/logtide/main/docker/parsers.conf curl -O https://raw.githubusercontent.com/logtide-dev/logtide/main/docker/extract_container_id.lua curl -O https://raw.githubusercontent.com/logtide-dev/logtide/main/docker/wrap_logs.lua # Set your LogTide API key in .env echo "FLUENT_BIT_API_KEY=your_api_key_here" >> .env # Start with logging profile docker compose --profile logging up -d
Docker Images: Docker Hub | GitHub Container Registry
Production: Pin versions with
LOGTIDE_BACKEND_IMAGE=logtide/backend:0.4.0in your.envfile.
ARM64 / Raspberry Pi: LogTide images support
linux/amd64andlinux/arm64. For Fluent Bit on ARM64, setFLUENT_BIT_IMAGE=cr.fluentbit.io/fluent/fluent-bit:4.2.2in your.envfile.
Horizontal Scaling: For scaling multiple backend instances, see deployment docs.
Deploy LogTide on any Kubernetes cluster with our official Helm chart.
Prerequisites: Kubernetes 1.25+, Helm 3.10+
-
Add the Helm repository
helm repo add logtide https://logtide-dev.github.io/logtide-helm-chart helm repo update
-
Install LogTide
helm install logtide logtide/logtide \ --namespace logtide \ --create-namespace \ --set timescaledb.auth.password=<your-db-password> \ --set redis.auth.password=<your-redis-password>
-
Access LogTide
kubectl port-forward svc/logtide-frontend 3000:3000 -n logtide
Open
http://localhost:3000
Includes: Backend (2+ replicas), Frontend, Worker, TimescaleDB, Redis, HPA, Ingress support, Prometheus monitoring.
Helm Chart: Artifact Hub | GitHub | Full Docs
We have ready-to-use SDKs for the most popular languages.
| Language | Status | Package / Link |
|---|---|---|
| Node.js | ✅ Ready | @logtide/sdk-node |
| Python | ✅ Ready | logtide-sdk |
| Go | ✅ Ready | logtide-sdk-go |
| PHP | ✅ Ready | logtide-dev/sdk-php |
| Kotlin | ✅ Ready | logtide-sdk-kotlin |
| C# / .NET | ✅ Ready | LogTide.SDK |
| Docker | ✅ Ready | Use Fluent Bit / Syslog driver |
| HTTP | ✅ Ready | API Reference |
| OpenTelemetry | ✅ Ready | OTLP endpoint (logs + traces) |
- ✅ High-Performance Ingestion: Batch API handling thousands of logs/sec.
- ✅ Real-time Live Tail: See logs as they arrive via Server-Sent Events (SSE).
- ✅ Powerful Search: Filter by service, level, time range. Two search modes: Full-text (word-based with stemming) and Substring (find text anywhere in messages, e.g., find "bluez" in "spa.bluez5.native").
- ✅ Multi-Organization: Isolate teams and projects strictly.
- ✅ Alerting: Get notified via Email or Webhook (Slack/Discord) on error spikes.
- ✅ Retention Policy: Automatic cleanup of old logs via TimescaleDB.
- ✅ Sigma Rules Detection: Built-in engine to run security detection rules (YAML) against your logs for threat detection.
- ✅ SIEM Dashboard: Security dashboard with incident management, MITRE ATT&CK mapping, and PDF report export. (New in 0.3.0)
- ✅ OpenTelemetry Support: Native OTLP ingestion for logs and traces (protobuf + JSON).
- ✅ Distributed Tracing: Trace viewer with span timeline, service dependencies graph, and trace-to-logs correlation.
LogTide goes beyond simple monitoring by transforming your logs into a security advantage. We support Sigma Rules, the industry-standard format for describing log signatures.
- Threat Detection: Automatically detect suspicious activities (e.g., SSH brute force, clearing of history, web shells).
- Standard Format: Write rules in standard YAML or import existing ones from the Sigma community.
- Real-time Matching: Rules are evaluated against incoming logs in real-time.
Example Rule (Detecting History Clear):
title: Clear Command History
status: stable
logsource:
product: linux
detection:
selection:
command:
- 'history -c'
- 'cat /dev/null > ~/.bash_history'
condition: selection
level: highLogTide now includes a full-featured Security Information and Event Management (SIEM) dashboard, turning your log platform into a lightweight security operations center.
- Summary Stats: Total detections, open incidents, critical alerts at a glance
- Top Threats Chart: Sigma rules ranked by detection count
- Detection Timeline: Time-series visualization of security events
- Affected Services: Quick view of which services triggered detections
- Severity Distribution: Pie chart breakdown (Critical/High/Medium/Low)
- MITRE ATT&CK Heatmap: Visualize detected techniques across the ATT&CK matrix
- Incident Workflow: Track incidents through Open → Investigating → Resolved → False Positive
- Comments & Collaboration: Add notes and discuss incidents with your team
- Activity Timeline: Full audit trail of all status changes and actions
- Detection Events: View matched fields and log context for each detection
- PDF Export: Generate incident reports for compliance and documentation
We use modern, type-safe tools to ensure performance and maintainability.
| Layer | Technology |
|---|---|
| Frontend | SvelteKit 5 (Runes) + TailwindCSS + shadcn-svelte |
| Backend | Fastify + TypeScript + Kysely ORM |
| Database | PostgreSQL 16 + TimescaleDB (Time-series optimization) |
| Queue | Redis 7 + BullMQ |
| Deployment | Docker + Docker Compose |
Distributed under the GNU AGPLv3 License. See LICENSE for more information.
- Free for Internal Use: You can use LogTide internally for free.
- Open Source: The code is available for audit and contribution.
- Commercial Protection: If you offer LogTide as a SaaS (Service) to others, you must release your source code or purchase a Commercial License.
![@dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=64&v=4){kind=small}