# Query logs with SQL, locally

> Log Query Workbench runs DuckDB — a real analytical SQL engine — entirely in your browser via WebAssembly. Drop a CSV, JSON, NDJSON, or Parquet log, write SQL (or use one-click canned analyses like top talkers and 4xx/5xx spikes), and get results instantly. Nothing is uploaded; your logs and queries never leave your device.

Live tool: https://lofttools.com/tools/dev-tools/log-query-workbench

Category: Dev Tools


## What it does

- Query CSV, TSV, JSON, NDJSON and Parquet files with full SQL — powered by DuckDB
- Real analytical engine: joins, window functions, quantiles, date_trunc, regexp
- One-click canned analyses: top talkers, status over time, 4xx/5xx spikes, slowest endpoints (p95/p99), volume by hour, auth failures
- Schema browser with auto-detected column types + row counts; click a table to query it
- Virtual-scrolled results grid handles large result sets smoothly
- Export query results to CSV, JSON or Parquet
- Runs 100% in your browser (WebAssembly) — logs and queries never leave your device
- Agent-callable via window.loft.tools for headless SQL over a dropped file

## How it works

1. **Drop a log or data file** — Drag a CSV, JSON, NDJSON or Parquet file onto the drop zone. DuckDB loads it in your browser and auto-detects the schema.
2. **Query with SQL** — Write SQL in the editor (Ctrl+Enter to run), click a table in the schema panel to start, or hit a one-click canned analysis.
3. **Read + export** — Browse results in the virtual grid, then export them to CSV, JSON or Parquet — all without anything leaving your device.

## FAQ

### Are my logs uploaded anywhere?

No. The query engine (DuckDB) runs in your browser via WebAssembly, and your file is read locally — your logs and queries never touch a server. Open DevTools' Network tab and you will see no data leave the page. The engine binary itself (~12 MB, the open-source DuckDB) downloads once from a CDN on first use and is then cached.

### What file formats can I query?

CSV, TSV, JSON, NDJSON and Parquet load directly with auto-detected schemas. Raw text log presets (Apache/Nginx/syslog) are on the roadmap; for now, structured exports work out of the box, and most tools can emit CSV or JSON.

### How large a file can I query?

There is no server limit — only your device's memory. DuckDB-WASM works in a 32-bit address space, so comfortable performance runs to roughly 1–1.5 GB of raw data per session on a desktop. For bigger data, convert to Parquet (columnar + compressed) first, which queries far more efficiently.

### Do I need to know SQL?

No — the one-click analyses (top talkers, error spikes, slowest endpoints, and more) generate the SQL for you over the columns they detect. The generated SQL is shown in the editor so you can tweak it, and the schema panel lets you click a table to start a query.

### Is this a replacement for Datadog or Grafana Loki?

No. This is a privacy-first, install-nothing workbench for ad-hoc analysis of a log file you already have — there is no live tail, alerting, or long-term storage. It complements a hosted platform for the quick 'let me slice this file right now without uploading it' case.

## Tips

- **Run with Ctrl+Enter** — Write SQL and press Ctrl/Cmd+Enter to run. Click a table in the schema panel to drop in a starter SELECT.
- **One-click analyses** — The Analyses panel detects log columns (ip, status, latency, path, ts) and generates SQL for top talkers, error spikes, slowest endpoints and more — editable before you run.
- **Everything stays local** — DuckDB runs in a WebAssembly worker on your device. Open DevTools → Network and watch your data never upload.

## Log Query Workbench vs. log tools

|  | Loft Log Workbench | Datadog / Loki | GoAccess | lnav (CLI) |
| --- | --- | --- | --- | --- |
| Runs locally (no upload) | Yes | No — ships to SaaS | Yes | Yes |
| Full SQL | Yes (DuckDB) | Query DSL | No | Limited SQL |
| Install required | No | Agent/SaaS | Yes | Yes |
| CSV / JSON / Parquet | Yes | Ingest pipeline | Web logs only | Many formats |
| Canned analyses | Yes | Dashboards | Yes (web) | Yes |
| Cost | Free | Per-GB | Free | Free |

_A privacy-first, install-nothing SQL workbench for ad-hoc log analysis — not a hosted observability platform. You bring the file; there is no live tail._

## Privacy — what we do not do

This tool runs entirely in the browser via WebAssembly. Your file never reaches a Loft Tools server. Specifically:

- **No upload.** The file bytes load into the browser tab's memory and process on your own CPU. Open DevTools → Network and observe zero outbound requests carrying file data while Query logs with SQL, locally runs.
- **No AI training on your file.** Loft does not train models. We could not train on a file we cannot see.
- **No content scanning.** No virus, copyright, or content-moderation pass against your file. The bytes are not accessible to us.
- **No server-side log of file contents, filenames, or EXIF metadata.** Cloudflare edge captures URL and truncated IP for abuse defense (standard CDN behaviour). Cloudflare Web Analytics records anonymous page hits, no cookies, no PII. Nothing about your file content reaches any log.
- **No retention.** Close the tab and the file leaves browser memory. No backups exist on our side because no copy ever existed on our side.
- **No account.** No email, no signup, no auth, no telemetry tied to you.
- **Offline-capable after first visit** (PWA). Once you've loaded a tool, it caches; later sessions work without internet. For high-sensitivity files, run the tool once online to warm the cache, then disconnect before processing.

Compare with upload-based services: each transmits your file to a processing server. Even over HTTPS, each has logs, retention windows, and subpoena exposure. Loft has none of these because the server architecture does not include your file.

## More

- All tools: https://lofttools.com/tools
- Category: https://lofttools.com/tools/dev-tools
- LLM index: https://lofttools.com/llms.txt