Loomstat ingests structured logs and gives them a query language that fits on an index card.
The complaint
Every log tool I have used has a query language I relearn every time I need it. The queries I actually write are simple — filter by a field, group by another, count — and the syntax should be too.
service=checkout level>=warn last=1h
| group status
| count
That is the whole language. Filters, a pipe, a handful of verbs.
Storage
Logs land in Postgres, partitioned by day, with the structured payload in jsonb and a GIN index on it. Not the fastest option available, but it means retention is a DROP TABLE, backups are ordinary backups, and I already know how to operate it.
What I learned
The ingest path is where all the difficulty lives. Producers send malformed JSON, duplicate events on retry, and timestamps from the future. Loomstat quarantines anything it cannot parse rather than dropping it, which has repeatedly turned "we are missing logs" into a five-minute answer instead of an afternoon.