Why I wrote yet another log shipper

Every serious log shipper I tried was good. That was the problem: each one was good at a hundred things, and I needed three. Tail some files, read a bit of journald, push batches somewhere. On a VPS with a gigabyte of RAM, I did not want the thing that moves my logs to be the biggest process on the box.

The constraints

I wrote them on an index card before writing any code:

• One static binary. No runtime, no plugins directory.
• A config file you can read without scrolling.
• Never lose lines silently. Block or spill to disk, but say so.
• Stay under 20 MB of memory on a normal day.

What I left out

Parsing, routing languages, a metrics pipeline, a web UI. Every one of those is reasonable, and every one would have doubled the code. If I need to parse something, Loki or a small consumer can do it after the fact.

The hardest part was not the tailing; it was deciding, again and again, not to add the next feature.

Where it is now

It has been shipping logs from four of my machines for most of the year. The docs live at fernwick.hi97.top. It will stay small.