Files, pipes or SSH
Analyze a local file, read stdin or stream a remote log using your existing SSH access. Parsing and aggregation happen on your machine.
Open-source developer tool · Starlit Digital
nora
Understand your NGINX traffic from the logs you already have.
nora reads access logs as a stream and builds a local report. Find busy paths, response errors and hourly traffic without sending your logs to an analytics service.
Find the useful patterns
Review request counts, response bytes, status codes, methods, top paths, clients, referrers, user agents and hourly traffic.
Text or JSON
Use a readable terminal report or JSON for scripts. Filter by time, set the number of top results and optionally mask client IPs.
Start from source
Install nora.
Requires Go 1.22 or later, Bash, Make and Python 3 for the installer. make build installs into ~/.local/bin; put that directory on PATH. SSH is only needed for remote logs.
git clone https://github.com/Starlit-Digital/nora.git
cd nora
make buildYour first workflow
Read. Inspect. Export.
Start with a local access.log. The SSH example uses an alias from your own SSH configuration.
nora analyze access.log --top 20
nora analyze access.log --format json --anonymize-ip
cat access.log | nora analyze -
nora analyze /var/log/nginx/access.log --ssh-host your-serverWorking boundaries
Keep the report in context.
nora supports common and combined access-log records. Malformed lines are counted; a file with no recognized records reports an error. Custom NGINX log formats may need adaptation.
Use --since and --until to select a time window. Configured remote targets can be explored with nora tui; your SSH credentials and log-read permissions remain yours to manage.
nora performs no DNS or geolocation lookups. IP masking does not remove every identifying detail: paths, referrers and user agents can still be sensitive. Review reports before sharing. Request totals describe log records, not unique people.
Source and documentation