# GoAccess — Analyze Web Server Logs in Real Time > Practical guide to GoAccess — analyze web server logs (Apache/Nginx) in a terminal dashboard or as an HTML report, with log-format tips for every use case. Source: https://www.jpkc.com/db/en/cheatsheets/web-servers/goaccess/ GoAccess is a fast open-source log analyzer that parses your web server logs in real time. You launch it straight from the terminal and get an interactive ncurses dashboard with visitors, top URLs, status codes and bandwidth – or you let it generate a standalone HTML report that even refreshes live over a WebSocket. The tool understands Apache and Nginx logs in Common and Combined Log Format as well as a range of cloud and CDN formats. The most common pitfall is getting `--log-format` right: if it does not match your log lines, the analysis stays empty or wrong. This guide walks you through the options you reach for daily, from live monitoring to a shareable report. ## Basic Usage `goaccess ` — Open a log file in the interactive terminal dashboard. GoAccess auto-detects common log formats. ```bash goaccess /var/log/nginx/access.log ``` `goaccess --log-format=COMBINED` — Parse a log file using the Apache/Nginx Combined Log Format (most common). ```bash goaccess /var/log/apache2/access.log --log-format=COMBINED ``` `goaccess --log-format=COMMON` — Parse a log file using the Apache Common Log Format. ```bash goaccess /var/log/apache2/access.log --log-format=COMMON ``` `cat | goaccess -` — Read log data from stdin (pipe). Use - as the file argument. ```bash cat /var/log/nginx/access.log | goaccess - ``` `goaccess --version` — Show the installed GoAccess version. ```bash goaccess --version ``` `goaccess --help` — Show a list of all available options and flags. ```bash goaccess --help ``` ## Log Format Configuration `goaccess --log-format=COMBINED` — Combined Log Format (Apache/Nginx default). Includes referrer and user agent. ```bash goaccess access.log --log-format=COMBINED ``` `goaccess --log-format=COMMON` — Common Log Format (Apache). Without referrer and user agent fields. ```bash goaccess access.log --log-format=COMMON ``` `goaccess --log-format=VCOMBINED` — Combined Log Format with virtual host prepended to each line. ```bash goaccess access.log --log-format=VCOMBINED ``` `goaccess --log-format=VCOMMON` — Common Log Format with virtual host prepended to each line. ```bash goaccess access.log --log-format=VCOMMON ``` `goaccess --log-format=W3C` — W3C Extended Log Format (IIS default format). ```bash goaccess access.log --log-format=W3C ``` `goaccess --log-format=SQUID` — Squid native access log format. ```bash goaccess access.log --log-format=SQUID ``` `goaccess --log-format=CLOUDFRONT` — Amazon CloudFront access log format. ```bash goaccess access.log --log-format=CLOUDFRONT ``` `goaccess --log-format=CLOUDSTORAGE` — Google Cloud Storage access log format. ```bash goaccess access.log --log-format=CLOUDSTORAGE ``` `goaccess --log-format=AWSELB` — Amazon Elastic Load Balancer access log format. ```bash goaccess access.log --log-format=AWSELB ``` `goaccess --log-format="%h %^[%d:%t %^] \"%r\" %s %b"` — Use a custom log format string. %h=host, %d=date, %t=time, %r=request, %s=status, %b=bytes. ```bash goaccess access.log --log-format="%h %^[%d:%t %^] \"%r\" %s %b" ``` ## Output: HTML Report `goaccess -o report.html --log-format=COMBINED` — Generate a standalone static HTML report file from a log file. ```bash goaccess access.log -o report.html --log-format=COMBINED ``` `goaccess -o /var/www/html/report.html --log-format=COMBINED` — Write the HTML report directly to a web-accessible directory. ```bash goaccess access.log -o /var/www/html/stats/report.html --log-format=COMBINED ``` `goaccess --log-format=COMBINED --real-time-html -o report.html` — Generate a real-time HTML report that auto-refreshes via WebSocket. ```bash goaccess access.log --log-format=COMBINED --real-time-html -o report.html ``` `goaccess --log-format=COMBINED --real-time-html --daemonize -o report.html` — Run GoAccess as a background daemon serving a live HTML report. ```bash goaccess access.log --log-format=COMBINED --real-time-html --daemonize -o report.html ``` `goaccess --log-format=COMBINED --real-time-html --port=7890 -o report.html` — Set a custom WebSocket port for the real-time HTML report (default: 7890). ```bash goaccess access.log --log-format=COMBINED --real-time-html --port=7890 -o report.html ``` `goaccess --log-format=COMBINED --html-report-title="My Site Stats" -o report.html` — Set a custom title for the HTML report. ```bash goaccess access.log --log-format=COMBINED --html-report-title="example.com Traffic" -o report.html ``` ## Output: JSON & CSV `goaccess -o report.json --log-format=COMBINED` — Generate a JSON report file from a log file. ```bash goaccess access.log -o report.json --log-format=COMBINED ``` `goaccess --log-format=COMBINED --output-format=json` — Output JSON data to stdout for piping or scripting. ```bash goaccess access.log --log-format=COMBINED --output-format=json | jq '.visitors' ``` `goaccess -o report.csv --log-format=COMBINED` — Generate a CSV report file from a log file. ```bash goaccess access.log -o report.csv --log-format=COMBINED ``` `goaccess --log-format=COMBINED --output-format=csv` — Output CSV data to stdout. ```bash goaccess access.log --log-format=COMBINED --output-format=csv ``` ## Multiple Log Files & Globbing `goaccess --log-format=COMBINED` — Parse multiple log files at once (combined analysis). ```bash goaccess access.log access.log.1 --log-format=COMBINED ``` `goaccess /var/log/nginx/access.log.* --log-format=COMBINED` — Parse all rotated log files matching a glob pattern. ```bash goaccess /var/log/nginx/access.log.* --log-format=COMBINED ``` `zcat /var/log/nginx/access.log.*.gz | goaccess - --log-format=COMBINED` — Decompress and pipe multiple gzipped log files into GoAccess. ```bash zcat /var/log/nginx/access.log.*.gz | goaccess - --log-format=COMBINED ``` `cat /var/log/nginx/access.log <(zcat /var/log/nginx/access.log.*.gz) | goaccess - --log-format=COMBINED` — Combine a current log with all rotated/compressed logs for a full history analysis. ```bash cat /var/log/nginx/access.log <(zcat /var/log/nginx/access.log.*.gz) | goaccess - --log-format=COMBINED ``` `goaccess /var/log/nginx/access.log -p /etc/goaccess/goaccess.conf --log-format=COMBINED --log-file /var/log/nginx/access.log.1` — Specify an additional log file via --log-file flag alongside the main file. ```bash goaccess access.log --log-file=access.log.1 --log-format=COMBINED ``` ## Filtering `goaccess --log-format=COMBINED --exclude-ip=` — Exclude a specific IP address from the analysis. ```bash goaccess access.log --log-format=COMBINED --exclude-ip=192.168.1.1 ``` `goaccess --log-format=COMBINED --exclude-ip=` — Exclude a CIDR range of IPs from the analysis. ```bash goaccess access.log --log-format=COMBINED --exclude-ip=10.0.0.0/8 ``` `grep 'GET /api' access.log | goaccess - --log-format=COMBINED` — Pre-filter log lines with grep before passing to GoAccess. ```bash grep 'GET /api' access.log | goaccess - --log-format=COMBINED ``` `goaccess --log-format=COMBINED --ignore-crawlers` — Exclude known web crawlers and bots from the analysis. ```bash goaccess access.log --log-format=COMBINED --ignore-crawlers ``` `goaccess --log-format=COMBINED --crawlers-only` — Show only requests from known crawlers and bots. ```bash goaccess access.log --log-format=COMBINED --crawlers-only ``` `goaccess --log-format=COMBINED --ignore-status=

` — Exclude a specific HTTP status code from the analysis (e.g. ignore 304).

```bash
goaccess access.log --log-format=COMBINED --ignore-status=304
```

`goaccess  --log-format=COMBINED --hide-referrer=` — Exclude a referrer domain from the referrers panel.

```bash
goaccess access.log --log-format=COMBINED --hide-referrer=example.com
```

`goaccess  --log-format=COMBINED --4xx-to-unique-count` — Count 4xx status responses as unique page views.

```bash
goaccess access.log --log-format=COMBINED --4xx-to-unique-count
```

## Date & Time Filtering

`goaccess  --log-format=COMBINED --date-format=%d/%b/%Y` — Set the date format for parsing (Combined default is %d/%b/%Y).

```bash
goaccess access.log --log-format=COMBINED --date-format=%d/%b/%Y
```

`awk -v d=$(date +%d/%b/%Y) '$0 ~ d' access.log | goaccess - --log-format=COMBINED` — Filter log for today's date using awk before passing to GoAccess.

```bash
awk -v d=$(date +%d/%b/%Y) '$0 ~ d' access.log | goaccess - --log-format=COMBINED
```

`awk '$4 >= "[01/Jan/2025" && $4 <= "[31/Jan/2025"' access.log | goaccess - --log-format=COMBINED` — Filter log entries between two dates using awk.

```bash
awk '$4 >= "[01/Jan/2025" && $4 <= "[31/Jan/2025"' access.log | goaccess - --log-format=COMBINED
```

`goaccess  --log-format=COMBINED --start-datetime="2025-01-01 00:00:00"` — Only process log entries from this start datetime onwards.

```bash
goaccess access.log --log-format=COMBINED --start-datetime="2025-01-01 00:00:00"
```

`goaccess  --log-format=COMBINED --end-datetime="2025-01-31 23:59:59"` — Only process log entries up to this end datetime.

```bash
goaccess access.log --log-format=COMBINED --end-datetime="2025-01-31 23:59:59"
```

`goaccess  --log-format=COMBINED --keep-last=` — Only analyze the last N days of log data.

```bash
goaccess access.log --log-format=COMBINED --keep-last=7
```

## GeoIP & Country Lookup

`goaccess  --log-format=COMBINED --geoip-database=` — Enable GeoIP lookups using a MaxMind GeoLite2-City.mmdb database file.

```bash
goaccess access.log --log-format=COMBINED --geoip-database=/usr/share/GeoIP/GeoLite2-City.mmdb
```

`goaccess  --log-format=COMBINED --geoip-database= --anonymize-ip` — Enable GeoIP and anonymize IP addresses in the output (GDPR compliance).

```bash
goaccess access.log --log-format=COMBINED --geoip-database=/usr/share/GeoIP/GeoLite2-City.mmdb --anonymize-ip
```

`goaccess  --log-format=COMBINED --anonymize-ip` — Anonymize IP addresses by masking the last octet (IPv4) or last 80 bits (IPv6).

```bash
goaccess access.log --log-format=COMBINED --anonymize-ip
```

## Panels & Display

`goaccess  --log-format=COMBINED --panel-sort-field=VISITORS` — Sort a panel by the visitors count (VISITORS, HITS, DATA, BW, AVGTS, CUMTS, MAXTS, PCT).

```bash
goaccess access.log --log-format=COMBINED --panel-sort-field=VISITORS
```

`goaccess  --log-format=COMBINED --max-items=` — Set the maximum number of items to display per panel.

```bash
goaccess access.log --log-format=COMBINED --max-items=20
```

`goaccess  --log-format=COMBINED --no-query-string` — Strip query strings from URLs. /page?id=1 and /page?id=2 are counted as one URL.

```bash
goaccess access.log --log-format=COMBINED --no-query-string
```

`goaccess  --log-format=COMBINED --enable-panel=REMOTE_USER` — Enable an additional panel (e.g. REMOTE_USER for HTTP Basic Auth usernames).

```bash
goaccess access.log --log-format=COMBINED --enable-panel=REMOTE_USER
```

`goaccess  --log-format=COMBINED --no-color` — Disable colorized terminal output.

```bash
goaccess access.log --log-format=COMBINED --no-color
```

`goaccess  --log-format=COMBINED --no-progress` — Disable the progress spinner/indicator while parsing.

```bash
goaccess access.log --log-format=COMBINED --no-progress
```

`goaccess  --log-format=COMBINED --444-as-404` — Treat Nginx non-standard 444 status code as 404.

```bash
goaccess access.log --log-format=COMBINED --444-as-404
```

## Configuration File

`goaccess -p /etc/goaccess/goaccess.conf ` — Use a specific configuration file instead of the default.

```bash
goaccess -p /etc/goaccess/goaccess.conf /var/log/nginx/access.log
```

`goaccess --config-file=~/.config/goaccess/goaccess.conf ` — Specify a user-level configuration file path.

```bash
goaccess --config-file=~/.config/goaccess/goaccess.conf access.log
```

`goaccess --config-dialog ` — Show the log format selection dialog at startup even if a config exists.

```bash
goaccess --config-dialog access.log
```

`goaccess --no-global-config ` — Ignore the global configuration file (/etc/goaccess/goaccess.conf).

```bash
goaccess --no-global-config --log-format=COMBINED access.log
```

## Common Workflows

`goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/html/stats.html && echo "Report generated"` — Generate an HTML report and print a success message.

```bash
goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/html/stats.html
```

`tail -f /var/log/nginx/access.log | goaccess - --log-format=COMBINED --real-time-html -o report.html` — Tail a live log and feed it into GoAccess for a real-time HTML dashboard.

```bash
tail -f /var/log/nginx/access.log | goaccess - --log-format=COMBINED --real-time-html -o /var/www/html/live.html
```

`goaccess /var/log/nginx/access.log --log-format=COMBINED --no-query-string --ignore-crawlers -o report.html` — Generate a clean HTML report without bots and without query string variations.

```bash
goaccess /var/log/nginx/access.log --log-format=COMBINED --no-query-string --ignore-crawlers -o report.html
```

`cat /var/log/nginx/access.log <(zcat /var/log/nginx/access.log.*.gz) | goaccess - --log-format=COMBINED -o full-report.html` — Combine current and all archived logs into a single comprehensive HTML report.

```bash
cat /var/log/nginx/access.log <(zcat /var/log/nginx/access.log.*.gz) | goaccess - --log-format=COMBINED -o full-report.html
```

`0 0 * * * root goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/html/stats/daily.html` — Crontab entry to regenerate the HTML report every day at midnight.

```bash
0 0 * * * root goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/html/stats/daily.html
```

`grep ' 404 ' access.log | goaccess - --log-format=COMBINED -o 404-report.html` — Generate a report containing only 404 Not Found requests.

```bash
grep ' 404 ' access.log | goaccess - --log-format=COMBINED -o 404-report.html
```

`grep 'Mozilla' access.log | grep -v 'bot\|crawler\|spider' | goaccess - --log-format=COMBINED` — Filter out bots by grepping for browser User-Agents before analysis.

```bash
grep 'Mozilla' access.log | grep -v 'bot\|crawler\|spider' | goaccess - --log-format=COMBINED
```

## Terminal Dashboard Keyboard Shortcuts

`F1 or h` — Show the help screen with all keyboard shortcuts.

```bash
F1 or h
```

`F5` — Redraw / refresh the terminal screen.

```bash
F5
```

`j / k or Arrow keys` — Scroll up and down within the active panel.

```bash
j / k
```

`TAB / Shift+TAB` — Move to the next / previous panel.

```bash
TAB
```

`ENTER` — Expand the selected panel to full screen.

```bash
ENTER
```

`0-9` — Jump directly to a panel by its number.

```bash
1 (Visitors), 2 (Requests), 3 (Static), 4 (404s)
```

`s` — Open the sort options dialog for the active panel.

```bash
s
```

`/` — Open the search dialog to filter entries in the active panel.

```bash
/
```

`n` — Jump to the next search result.

```bash
n
```

`g / G` — Jump to the first / last item in the active panel.

```bash
g / G
```

`o or ENTER` — Expand or open the highlighted item.

```bash
o
```

`c` — Set a custom color scheme in the terminal dashboard.

```bash
c
```

`q` — Quit GoAccess (or close the expanded panel view).

```bash
q
```


## Conclusion

GoAccess is the fastest answer to the question "what is happening on my server right now?" – with no tracking script or external analytics involved. Above all, get the `--log-format` right: once it matches, the rest almost runs itself. For live monitoring, reach for the terminal dashboard or the `--real-time-html` report; for shareable analyses, a static HTML report regenerated regularly via a cron job is all you need.

## Further Reading

- [GoAccess – official website](https://goaccess.io/) – downloads, features and documentation
- [GoAccess – manual page](https://goaccess.io/man) – every option and log-format directive at a glance
- [GoAccess – Wikipedia](https://en.wikipedia.org/wiki/GoAccess) – background and history


## Related Commands

- [apache](https://www.jpkc.com/db/en/cheatsheets/web-servers/apache/) – web server whose access logs GoAccess parses
- [caddy](https://www.jpkc.com/db/en/cheatsheets/web-servers/caddy/) – modern web server with automatic HTTPS
- [certbot](https://www.jpkc.com/db/en/cheatsheets/web-servers/certbot/) – Let's Encrypt certificates for your web server