Caddy-analyzer — Native log analysis + security detection for Caddy v2

Showcase
1

Hey Caddy community,
I built caddy-analyzer, a CLI tool written in Go that natively parses Caddy v2’s structured JSON logs — no config, no regex hacking.

Caddy’s JSON log format is great, but tools like goaccess, lnav, or grep/awk pipelines can’t parse it out of the box. This fills that gap.

  • Full analysis — aggregate stats, RPS, latency percentiles (P50/P95/P99), status breakdown, bandwidth, top paths/IPs/UAs
  • Security detection engine — 22 attack categories (SQLi, XSS, SSTI, SSRF, RCE, LFI, Log4j, GraphQL introspection, prototype pollution, scanner detection, etc.) with a dual-pass engine that catches double-encoded and multibyte-encoded bypass attempts
  • Real-time iptables guard (caddy-analyze guard) — auto-blocks offending IPs at the firewall with configurable thresholds
  • Multi-source readers — local files, stdin, Docker (docker://container), Kubernetes (k8s://pod), systemd journalctl
  • TUI dashboard (–watch) — 6-tab interactive interface (summary, live stream, security alerts, top IPs/paths/UAs)
  • Diff engine — compare two log files for RPS/5xx/latency regressions
  • Output formats — table, JSON, CSV, standalone HTML report
  • Filters — time range, CIDR, status classes, methods, path globs, bot/crawler classification

Quick start
curl -sSfL https://raw.githubusercontent.com/L9Lenny/caddy-analyzer/main/install.sh | sh

Analyze your Caddy logs with security detection

caddy-analyze --detect /var/log/caddy/access.log

Or tail live from a Docker container

caddy-analyze tail --detect docker://my-caddy

Generate an HTML report

caddy-analyze -f html -o report.html --detect

Launch the TUI

caddy-analyze --watch
Links