// the find
control-theory/gonzo
Gonzo! The Go based TUI log analysis tool
Gonzo is a terminal UI for real-time log analysis, inspired by k9s. It ingests logs from stdin, files, Kubernetes pods, or OTLP receivers and gives you charts, severity tracking, and AI-powered pattern analysis in a split-pane TUI. The embedded Dstl8 Lite web dashboard (React + WebSocket) runs alongside it automatically, which is either convenient or surprising depending on your security posture.
First-class OTLP support — acting as both a receiver and consumer means you can point your OTel collector directly at Gonzo without any intermediate step. The drain3 pattern extraction per severity level is genuinely useful for noisy services: it groups log chatter into recurring templates so you see 'DB connection failed (47 times)' instead of 47 individual lines. Multi-provider AI integration is done cleanly — OpenAI-compatible, Ollama, LM Studio, and Claude Code all work through a single abstraction with runtime model switching. The Claude Code path specifically invokes the CLI subprocess rather than needing a raw API key, which is a practical choice for developers who are already authenticated.
The web dashboard starts automatically and binds to port 5718 on all interfaces unless you explicitly disable it — there is no auth, so anyone on the same network can watch your logs through a browser. The log buffer defaults to 1000 entries and lives entirely in memory with no persistence, so if you close Gonzo you lose everything; there is no session save or export beyond piping stdout elsewhere. The AI analysis sends log content to external APIs by default, which is a problem the moment your logs contain PII or secrets — there is no scrubbing or redaction layer. The embedded React build being committed to the repo (web/dist) rather than built at release time is a maintenance antipattern that will quietly diverge from the source.