Gonzo: a k9s-inspired terminal UI for real-time log analysis, with OTLP, Kubernetes and AI insights
Gonzo! The Go based TUI log analysis tool
At a glance
- What is it?
- Gonzo by ControlTheory is an MIT-licensed, Go-based terminal UI for analysing log streams in real time. Inspired by k9s, it processes logs from stdin, files, Kubernetes or an OpenTelemetry receiver, shows charts and severity heatmaps, and can launch a local browser dashboard called Dstl8.Lite.
- Who is it for?
- Try Gonzo if you live in the terminal and want a fast, k9s-style view of live logs from stdin, files, Kubernetes or OpenTelemetry. Pipe logs into gonzo, use its charts and severity filters, press d for the Dstl8.Lite web dashboard, and wire an OpenAI-compatible or Ollama model if you want AI summaries.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 4 days ago.
- What is it written in?
- Mainly Go, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
What Gonzo is and who it is for
Gonzo is a real-time log-analysis terminal UI written in Go, and its clearest reference point is k9s: it borrows that tool's familiar 2x2 grid layout and applies it to log streams instead of Kubernetes objects. It analyses logs as they arrive, drawing charts, severity distributions and heatmaps, with advanced filtering and optional AI-powered insights.
The people it fits are developers and operators who already work in a terminal and want to make sense of a live log stream without shipping it to a heavyweight platform first. Because it reads from stdin, files or a network receiver, it slots into an existing workflow: pipe a service's output into it, tail a file, or point it at a Kubernetes cluster. It is sponsored by and associated with ControlTheory, but the tool itself is open source and runs entirely locally.
Where Gonzo gets its logs
Input flexibility is a core strength. Gonzo does live streaming from stdin, files or the network, processing entries as they arrive. It is Kubernetes-native, integrating directly with clusters to stream pod logs, and OTLP-native, with first-class support for the OpenTelemetry log format and a built-in gRPC server that can receive logs over the OpenTelemetry protocol.
It detects formats automatically, recognising JSON, logfmt and plain text, and you can define your own formats with YAML configuration when your logs do not fit those. The documentation lists integration examples for a long list of hosts, including Vercel, Supabase, Railway, Cloudflare Workers, Netlify, Fly.io, Render and AWS CloudWatch, so in practice most places you already send logs can feed Gonzo. That range is what lets it be a single lens over logs from very different sources.
The dashboard and how you navigate it
The interactive dashboard is where the k9s inspiration shows. The 2x2 grid presents real-time charts, word frequency, attributes, severity distribution and a time series, alongside a smart log viewer that auto-scrolls but pauses intelligently. Navigation is both keyboard and mouse: Vim-style shortcuts plus click-to-navigate and scroll-wheel support. Pressing f opens a dedicated fullscreen log viewer, and the spacebar is a global pause that buffers logs while you read.
Filtering is thorough. There is regex support, attribute search, an interactive severity-selection modal on Ctrl+f, Kubernetes namespace and pod filtering on Ctrl+k, and multi-level severity selection. Modal detail views let you expand an individual log entry, and a log-counts analysis modal adds heatmap visualisation, pattern analysis by severity and service distribution. For appearance, Gonzo ships more than 11 themes, including Dracula, Nord, Monokai and GitHub Light, with light and dark variants and custom skins defined in YAML.
Dstl8.Lite, the built-in web dashboard
Gonzo is not limited to the terminal. Pressing d from any view launches Dstl8.Lite, a local browser-based dashboard that streams the same logs Gonzo is analysing into a richer GUI, with workspaces, pattern detection, severity heatmaps and live log search, all running locally and powered by Gonzo underneath.
The implementation detail that makes this convenient is that Dstl8.Lite is an embedded React UI served directly from the Gonzo binary, with no external dependencies. It updates over WebSocket with roughly one-second refresh, and adds interactive time-series severity charts with stream-level filtering, a sentiment heatmap grouped by pod, namespace, service, host or deployment, Drain3-powered pattern analysis and a source browser with dimension breakdowns, plus automatic light and dark mode. So you get a terminal tool and a local web dashboard from the same single binary, which is unusual and genuinely useful when you want to share a view on a wider screen without standing up a server.
AI insights and the stack underneath
Gonzo's AI features are optional and configurable. It can produce intelligent insights about log patterns and anomalies with configurable models, doing pattern detection to identify recurring issues and anomaly analysis to spot the unusual. The topics and dependencies show the model side is provider-flexible, with OpenAI and Ollama both in scope, so you can point it at a hosted OpenAI-compatible endpoint or a local model.
Under the hood it is a modern Go application. go.mod shows the Charm libraries (Bubble Tea, Bubbles, Lip Gloss, Glamour) behind the TUI, the OpenTelemetry OTLP proto and gRPC for the receiver, the Kubernetes client libraries for pod streaming, go-drain3 for pattern detection and an embedded websocket server for the web dashboard. The Makefile builds a single trimmed binary with version metadata, and there is a flake.nix for Nix users. Because CGO is disabled by default, the result is a self-contained static binary.
Licence, releases and limits
Gonzo is MIT licensed and needs Go 1.21 or newer to build (the module itself targets a newer Go). Recent releases are v0.4.3 on 2026-07-15, v0.4.2 on 2026-05-15 and v0.4.1 on 2026-05-07, and the last push was on 2026-09-11, so it is actively developed. It is listed on skills.sh and ships a .claude-plugin directory, reflecting the AI-assisted angle.
The limits are those of a young 0.4.x tool. The version number signals that interfaces and features may still shift, so pin a release if you script around it. The AI insights depend on a model you supply and configure, and their usefulness will track that model's quality and your prompt configuration rather than being guaranteed. And while the input list is broad, unusual log formats will need a YAML custom-format definition. None of that undercuts the core: for real-time, local, terminal-first log analysis with OTLP and Kubernetes support, Gonzo covers a lot of ground in one binary.
Editorial conclusion
Try Gonzo if you live in the terminal and want a fast, k9s-style view of live logs from stdin, files, Kubernetes or OpenTelemetry. Pipe logs into gonzo, use its charts and severity filters, press d for the Dstl8.Lite web dashboard, and wire an OpenAI-compatible or Ollama model if you want AI summaries. It is a single Go binary that needs no external services.
Frequently asked questions
What is Gonzo used for?
Gonzo is a Go-based terminal UI for real-time log analysis. It reads logs from stdin, files, Kubernetes or an OpenTelemetry receiver and shows charts, severity heatmaps, filtering and optional AI insights, in a k9s-style dashboard.
Which log sources and formats does Gonzo support?
It streams from stdin, files, the network, Kubernetes pods and an OTLP gRPC receiver, and auto-detects JSON, logfmt and plain text. You can define custom formats in YAML, and the docs list integrations for hosts like Vercel, Cloudflare, Fly.io and AWS CloudWatch.
What is Dstl8.Lite and do I need to install it separately?
No. Dstl8.Lite is a local browser dashboard embedded in the Gonzo binary. Press d from any Gonzo view to launch it; it streams the same logs over WebSocket with workspaces, severity heatmaps, pattern detection and live search, running entirely locally.
Community notes