Goaccess: Additional features that would be cool

[dsl101]

Apologies if there's a better place for these - I couldn't find a wish list anywhere...

In no particular order, these are things I've have to find workarounds for or am having to resort to other means:

• Ability to 'filter' the results within the UI - e.g. select an entry in the 'Hosts' section, then display only data for that host, or enter a regex to match in the request and restrict display to only those matching entries
• Some kind of 'frequency' display - not sure how it should look yet, but I'd like to know how often and how regularly certain hosts or pages, etc. appear in the logs
• Ability to replay the logs (useful when troubleshooting, and would probably be done offline, from another host)
• Ability to dynamically set start / end time / date for the displayed results (sort of like filter above I suppose)

I'm sure there are other things I've forgotten - please let me know if there's a better place to put these things!

[allinurl]

1. This is definitely something that will be implemented and in fact is already on the to-do list.
2. I can look into this as well, sounds like it could be useful.
3. What do you mean with replay the logs? the latest version added data persistence which you could use to load previously stored data.
4. The filter should be able to handle this.

Thanks for the suggestions. Please keep this open.

[dsl101]

Thanks - great to hear about the planned features.

Regarding replay, I'm having a problem with a server at the moment which responds badly to certain requests - no errors thrown, it just slowly grinds to a halt. What I'd like to be able to do, to narrow down the problem, is select a date/time range in the log file, and have another machine (the one I'm running goaccess on) make exactly those requests, with the same relative timestamps (i.e. same 'gaps' between subsequent requests), to see if I can reproduce the error. By selecting ever smaller portions of the log to replay, I'd hope to track down the offending URL(s), or specific sequence of URLs that is causing the problem.

Does that make sense? I tried this script, but it's very old, and gave lots of include errors on the first try. Looks like development has stalled, but I might pick it up if you don't have plans in this direction for goaccess...

[allinurl]

I think I understand the main concept, however, I'm still wondering how goaccess would help you identify the offending requests?

[dsl101]

In our case, we _think_ the problem comes from a crawler at a specific IP address. So, it would be really helpful to be able select that host, then replay that last 100 requests (in 'real time' - i.e. as they happened), or the last 30 minutes / 1 hour, etc., so we can watch what the server does as those requests come in.

[stavros-liaskos]

is 1. already implemented? If not is there a workaround to generate country/url/market specific report?

[allinurl]

@stavros-liaskos It hasn't been implemented yet. #117 will address this. Right now you can do some pre-processing with tools like grep, awk, sed, etc. Note that you can still preserve the real-time functionality when piping data in, e.g.,

tail -f access.log | grep -i --line-buffered 'firefox' | goaccess -