fog clears

From raw access logs to figures you can recount.

knockstat keeps the pipeline short: collect, parse, enrich, store, report. Every event is stored, so any figure can be recounted from the raw input.

ingestnginx / caddy / traefik
enrichgeo + bot + device
storeclickhouse

route map

The pipeline

Each step keeps the request trail visible, like city lights through fog.

1. Collect

1. Collect

The knockstat agent tails log files, Docker containers or Kubernetes pod logs and ships each request to ingest. Vector and Fluent Bit can post to the same endpoint, and the browser script and SDKs send page views and custom events.

2. Parse

2. Parse

Read method, path, status, bytes, referrer and user agent from seven access-log formats.

3. Enrich

3. Enrich

Add country, a bot flag, device, browser and OS. The client IP feeds the country lookup and a daily visitor hash, and is never stored.

4. Report

4. Report

The dashboard and the product reports query the events in ClickHouse. Sessions are built at query time.

san francisco signal

Designed for production traffic

Traffic figures and error pages sit in the same dashboard.

A

Recountable

CI recounts every dashboard figure and every report from the raw input, and the two must agree.

B

No client tag required

Access logs count visits when JavaScript is blocked or pages are static. The optional script sets no cookies.

C

Several sites

One dashboard covers several sites, with per-site counts and a site filter.

launch from the pier

Ready to connect logs?

Ask for hosted access, or run knockstat on your own servers.