GoAccess — Analyze Web Server Logs in Real Time

GoAccess is a fast open-source log analyzer that parses your web server logs in real time. You launch it straight from the terminal and get an interactive ncurses dashboard with visitors, top URLs, status codes and bandwidth – or you let it generate a standalone HTML report that even refreshes live over a WebSocket. The tool understands Apache and Nginx logs in Common and Combined Log Format as well as a range of cloud and CDN formats. The most common pitfall is getting --log-format right: if it does not match your log lines, the analysis stays empty or wrong. This guide walks you through the options you reach for daily, from live monitoring to a shareable report.

Basic Usage

goaccess <logfile> — Open a log file in the interactive terminal dashboard. GoAccess auto-detects common log formats.

goaccess /var/log/nginx/access.log

goaccess <logfile> --log-format=COMBINED — Parse a log file using the Apache/Nginx Combined Log Format (most common).

goaccess /var/log/apache2/access.log --log-format=COMBINED

goaccess <logfile> --log-format=COMMON — Parse a log file using the Apache Common Log Format.

goaccess /var/log/apache2/access.log --log-format=COMMON

cat <logfile> | goaccess - — Read log data from stdin (pipe). Use - as the file argument.

cat /var/log/nginx/access.log | goaccess -

goaccess --version — Show the installed GoAccess version.

goaccess --version

goaccess --help — Show a list of all available options and flags.

goaccess --help

Log Format Configuration

goaccess <logfile> --log-format=COMBINED — Combined Log Format (Apache/Nginx default). Includes referrer and user agent.

goaccess access.log --log-format=COMBINED

goaccess <logfile> --log-format=COMMON — Common Log Format (Apache). Without referrer and user agent fields.

goaccess access.log --log-format=COMMON

goaccess <logfile> --log-format=VCOMBINED — Combined Log Format with virtual host prepended to each line.

goaccess access.log --log-format=VCOMBINED

goaccess <logfile> --log-format=VCOMMON — Common Log Format with virtual host prepended to each line.

goaccess access.log --log-format=VCOMMON

goaccess <logfile> --log-format=W3C — W3C Extended Log Format (IIS default format).

goaccess access.log --log-format=W3C

goaccess <logfile> --log-format=SQUID — Squid native access log format.

goaccess access.log --log-format=SQUID

goaccess <logfile> --log-format=CLOUDFRONT — Amazon CloudFront access log format.

goaccess access.log --log-format=CLOUDFRONT

goaccess <logfile> --log-format=CLOUDSTORAGE — Google Cloud Storage access log format.

goaccess access.log --log-format=CLOUDSTORAGE

goaccess <logfile> --log-format=AWSELB — Amazon Elastic Load Balancer access log format.

goaccess access.log --log-format=AWSELB

goaccess <logfile> --log-format="%h %^[%d:%t %^] \"%r\" %s %b" — Use a custom log format string. %h=host, %d=date, %t=time, %r=request, %s=status, %b=bytes.

goaccess access.log --log-format="%h %^[%d:%t %^] \"%r\" %s %b"

Output: HTML Report

goaccess <logfile> -o report.html --log-format=COMBINED — Generate a standalone static HTML report file from a log file.

goaccess access.log -o report.html --log-format=COMBINED

goaccess <logfile> -o /var/www/html/report.html --log-format=COMBINED — Write the HTML report directly to a web-accessible directory.

goaccess access.log -o /var/www/html/stats/report.html --log-format=COMBINED

goaccess <logfile> --log-format=COMBINED --real-time-html -o report.html — Generate a real-time HTML report that auto-refreshes via WebSocket.

goaccess access.log --log-format=COMBINED --real-time-html -o report.html

goaccess <logfile> --log-format=COMBINED --real-time-html --daemonize -o report.html — Run GoAccess as a background daemon serving a live HTML report.

goaccess access.log --log-format=COMBINED --real-time-html --daemonize -o report.html

goaccess <logfile> --log-format=COMBINED --real-time-html --port=7890 -o report.html — Set a custom WebSocket port for the real-time HTML report (default: 7890).

goaccess access.log --log-format=COMBINED --real-time-html --port=7890 -o report.html

goaccess <logfile> --log-format=COMBINED --html-report-title="My Site Stats" -o report.html — Set a custom title for the HTML report.

goaccess access.log --log-format=COMBINED --html-report-title="example.com Traffic" -o report.html

Output: JSON & CSV

goaccess <logfile> -o report.json --log-format=COMBINED — Generate a JSON report file from a log file.

goaccess access.log -o report.json --log-format=COMBINED

goaccess <logfile> --log-format=COMBINED --output-format=json — Output JSON data to stdout for piping or scripting.

goaccess access.log --log-format=COMBINED --output-format=json | jq '.visitors'

goaccess <logfile> -o report.csv --log-format=COMBINED — Generate a CSV report file from a log file.

goaccess access.log -o report.csv --log-format=COMBINED

goaccess <logfile> --log-format=COMBINED --output-format=csv — Output CSV data to stdout.

goaccess access.log --log-format=COMBINED --output-format=csv

Multiple Log Files & Globbing

goaccess <logfile1> <logfile2> --log-format=COMBINED — Parse multiple log files at once (combined analysis).

goaccess access.log access.log.1 --log-format=COMBINED

goaccess /var/log/nginx/access.log.* --log-format=COMBINED — Parse all rotated log files matching a glob pattern.

goaccess /var/log/nginx/access.log.* --log-format=COMBINED

zcat /var/log/nginx/access.log.*.gz | goaccess - --log-format=COMBINED — Decompress and pipe multiple gzipped log files into GoAccess.

zcat /var/log/nginx/access.log.*.gz | goaccess - --log-format=COMBINED

cat /var/log/nginx/access.log <(zcat /var/log/nginx/access.log.*.gz) | goaccess - --log-format=COMBINED — Combine a current log with all rotated/compressed logs for a full history analysis.

cat /var/log/nginx/access.log <(zcat /var/log/nginx/access.log.*.gz) | goaccess - --log-format=COMBINED

goaccess /var/log/nginx/access.log -p /etc/goaccess/goaccess.conf --log-format=COMBINED --log-file /var/log/nginx/access.log.1 — Specify an additional log file via --log-file flag alongside the main file.

goaccess access.log --log-file=access.log.1 --log-format=COMBINED

Filtering

goaccess <logfile> --log-format=COMBINED --exclude-ip=<ip> — Exclude a specific IP address from the analysis.

goaccess access.log --log-format=COMBINED --exclude-ip=192.168.1.1

goaccess <logfile> --log-format=COMBINED --exclude-ip=<cidr> — Exclude a CIDR range of IPs from the analysis.

goaccess access.log --log-format=COMBINED --exclude-ip=10.0.0.0/8

grep 'GET /api' access.log | goaccess - --log-format=COMBINED — Pre-filter log lines with grep before passing to GoAccess.

grep 'GET /api' access.log | goaccess - --log-format=COMBINED

goaccess <logfile> --log-format=COMBINED --ignore-crawlers — Exclude known web crawlers and bots from the analysis.

goaccess access.log --log-format=COMBINED --ignore-crawlers

goaccess <logfile> --log-format=COMBINED --crawlers-only — Show only requests from known crawlers and bots.

goaccess access.log --log-format=COMBINED --crawlers-only

goaccess <logfile> --log-format=COMBINED --ignore-status=<code> — Exclude a specific HTTP status code from the analysis (e.g. ignore 304).

goaccess access.log --log-format=COMBINED --ignore-status=304

goaccess <logfile> --log-format=COMBINED --hide-referrer=<domain> — Exclude a referrer domain from the referrers panel.

goaccess access.log --log-format=COMBINED --hide-referrer=example.com

goaccess <logfile> --log-format=COMBINED --4xx-to-unique-count — Count 4xx status responses as unique page views.

goaccess access.log --log-format=COMBINED --4xx-to-unique-count

Date & Time Filtering

goaccess <logfile> --log-format=COMBINED --date-format=%d/%b/%Y — Set the date format for parsing (Combined default is %d/%b/%Y).

goaccess access.log --log-format=COMBINED --date-format=%d/%b/%Y

awk -v d=$(date +%d/%b/%Y) '$0 ~ d' access.log | goaccess - --log-format=COMBINED — Filter log for today's date using awk before passing to GoAccess.

awk -v d=$(date +%d/%b/%Y) '$0 ~ d' access.log | goaccess - --log-format=COMBINED

awk '$4 >= "[01/Jan/2025" && $4 <= "[31/Jan/2025"' access.log | goaccess - --log-format=COMBINED — Filter log entries between two dates using awk.

awk '$4 >= "[01/Jan/2025" && $4 <= "[31/Jan/2025"' access.log | goaccess - --log-format=COMBINED

goaccess <logfile> --log-format=COMBINED --start-datetime="2025-01-01 00:00:00" — Only process log entries from this start datetime onwards.

goaccess access.log --log-format=COMBINED --start-datetime="2025-01-01 00:00:00"

goaccess <logfile> --log-format=COMBINED --end-datetime="2025-01-31 23:59:59" — Only process log entries up to this end datetime.

goaccess access.log --log-format=COMBINED --end-datetime="2025-01-31 23:59:59"

goaccess <logfile> --log-format=COMBINED --keep-last=<days> — Only analyze the last N days of log data.

goaccess access.log --log-format=COMBINED --keep-last=7

GeoIP & Country Lookup

goaccess <logfile> --log-format=COMBINED --geoip-database=<path> — Enable GeoIP lookups using a MaxMind GeoLite2-City.mmdb database file.

goaccess access.log --log-format=COMBINED --geoip-database=/usr/share/GeoIP/GeoLite2-City.mmdb

goaccess <logfile> --log-format=COMBINED --geoip-database=<path> --anonymize-ip — Enable GeoIP and anonymize IP addresses in the output (GDPR compliance).

goaccess access.log --log-format=COMBINED --geoip-database=/usr/share/GeoIP/GeoLite2-City.mmdb --anonymize-ip

goaccess <logfile> --log-format=COMBINED --anonymize-ip — Anonymize IP addresses by masking the last octet (IPv4) or last 80 bits (IPv6).

goaccess access.log --log-format=COMBINED --anonymize-ip

Panels & Display

goaccess <logfile> --log-format=COMBINED --panel-sort-field=VISITORS — Sort a panel by the visitors count (VISITORS, HITS, DATA, BW, AVGTS, CUMTS, MAXTS, PCT).

goaccess access.log --log-format=COMBINED --panel-sort-field=VISITORS

goaccess <logfile> --log-format=COMBINED --max-items=<n> — Set the maximum number of items to display per panel.

goaccess access.log --log-format=COMBINED --max-items=20

goaccess <logfile> --log-format=COMBINED --no-query-string — Strip query strings from URLs. /page?id=1 and /page?id=2 are counted as one URL.

goaccess access.log --log-format=COMBINED --no-query-string

goaccess <logfile> --log-format=COMBINED --enable-panel=REMOTE_USER — Enable an additional panel (e.g. REMOTE_USER for HTTP Basic Auth usernames).

goaccess access.log --log-format=COMBINED --enable-panel=REMOTE_USER

goaccess <logfile> --log-format=COMBINED --no-color — Disable colorized terminal output.

goaccess access.log --log-format=COMBINED --no-color

goaccess <logfile> --log-format=COMBINED --no-progress — Disable the progress spinner/indicator while parsing.

goaccess access.log --log-format=COMBINED --no-progress

goaccess <logfile> --log-format=COMBINED --444-as-404 — Treat Nginx non-standard 444 status code as 404.

goaccess access.log --log-format=COMBINED --444-as-404

Configuration File

goaccess -p /etc/goaccess/goaccess.conf <logfile> — Use a specific configuration file instead of the default.

goaccess -p /etc/goaccess/goaccess.conf /var/log/nginx/access.log

goaccess --config-file=~/.config/goaccess/goaccess.conf <logfile> — Specify a user-level configuration file path.

goaccess --config-file=~/.config/goaccess/goaccess.conf access.log

goaccess --config-dialog <logfile> — Show the log format selection dialog at startup even if a config exists.

goaccess --config-dialog access.log

goaccess --no-global-config <logfile> — Ignore the global configuration file (/etc/goaccess/goaccess.conf).

goaccess --no-global-config --log-format=COMBINED access.log

Common Workflows

goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/html/stats.html && echo "Report generated" — Generate an HTML report and print a success message.

goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/html/stats.html

tail -f /var/log/nginx/access.log | goaccess - --log-format=COMBINED --real-time-html -o report.html — Tail a live log and feed it into GoAccess for a real-time HTML dashboard.

tail -f /var/log/nginx/access.log | goaccess - --log-format=COMBINED --real-time-html -o /var/www/html/live.html

goaccess /var/log/nginx/access.log --log-format=COMBINED --no-query-string --ignore-crawlers -o report.html — Generate a clean HTML report without bots and without query string variations.

goaccess /var/log/nginx/access.log --log-format=COMBINED --no-query-string --ignore-crawlers -o report.html

cat /var/log/nginx/access.log <(zcat /var/log/nginx/access.log.*.gz) | goaccess - --log-format=COMBINED -o full-report.html — Combine current and all archived logs into a single comprehensive HTML report.

cat /var/log/nginx/access.log <(zcat /var/log/nginx/access.log.*.gz) | goaccess - --log-format=COMBINED -o full-report.html

0 0 * * * root goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/html/stats/daily.html — Crontab entry to regenerate the HTML report every day at midnight.

0 0 * * * root goaccess /var/log/nginx/access.log --log-format=COMBINED -o /var/www/html/stats/daily.html

grep ' 404 ' access.log | goaccess - --log-format=COMBINED -o 404-report.html — Generate a report containing only 404 Not Found requests.

grep ' 404 ' access.log | goaccess - --log-format=COMBINED -o 404-report.html

grep 'Mozilla' access.log | grep -v 'bot\|crawler\|spider' | goaccess - --log-format=COMBINED — Filter out bots by grepping for browser User-Agents before analysis.

grep 'Mozilla' access.log | grep -v 'bot\|crawler\|spider' | goaccess - --log-format=COMBINED

Terminal Dashboard Keyboard Shortcuts

F1 or h — Show the help screen with all keyboard shortcuts.

F1 or h

F5 — Redraw / refresh the terminal screen.

F5

j / k or Arrow keys — Scroll up and down within the active panel.

j / k

TAB / Shift+TAB — Move to the next / previous panel.

TAB

ENTER — Expand the selected panel to full screen.

ENTER

0-9 — Jump directly to a panel by its number.

1 (Visitors), 2 (Requests), 3 (Static), 4 (404s)

s — Open the sort options dialog for the active panel.

/ — Open the search dialog to filter entries in the active panel.

n — Jump to the next search result.

g / G — Jump to the first / last item in the active panel.

g / G

o or ENTER — Expand or open the highlighted item.

c — Set a custom color scheme in the terminal dashboard.

q — Quit GoAccess (or close the expanded panel view).

Conclusion

GoAccess is the fastest answer to the question "what is happening on my server right now?" – with no tracking script or external analytics involved. Above all, get the --log-format right: once it matches, the rest almost runs itself. For live monitoring, reach for the terminal dashboard or the --real-time-html report; for shareable analyses, a static HTML report regenerated regularly via a cron job is all you need.