Using jq to inspect Caddy logfiles

If you happen to use Caddy as your webserver, you might have noticed that it logs in JSON format. This is great for machine parsing, but not so much for humans. This is where jq comes in handy. It's a lightweight and flexible command-line JSON processor. It's like sed for JSON data.

To get started, you can install jq using your package manager. For example, on macOS you can use Homebrew:

1brew install jq

Once you have jq installed, you can use it to inspect Caddy logfiles. For example, to see the last 10 log entries:

1tail -n 10 /var/log/caddy/access.log | jq

This will pretty-print the last 10 log entries. You can also use jq to filter the log entries. For example, to only show log entries with a status code of 404:

1cat /var/log/caddy/access.log | jq 'select(.status == 404)'

This will only show log entries with a status code of 404. You can also use jq to extract specific fields from the log entries. For example, to only show the request path and status code:

1cat /var/log/caddy/access.log | jq '{path: .request.uri, status: .status}'

This will only show the request path and status code for each log entry.

You can also use it to output the log entries in a different format. For example, to output the log entries as CSV:

1cat /var/log/caddy/access.log | jq -r '[.ts, .request.uri, .status] | @csv'

You can also reformat the timestamps for example:

1cat /var/log/caddy/access.log | jq '.ts |= (todateiso8601)' | jq -r '\(.ts) \(.status) \(.request.uri)'