grep for your whole fleet.
Ferrite searches, tails, and pretty-prints logs across every server you own.
One static binary, zero agents, written in Rust because
ssh h1 'grep ...' & ssh h2 'grep ...' was never a plan.
$ curl -fsSL https://ferrite.dev/install.sh | sh
Linux (x86_64, aarch64), macOS, and one BSD we test when we remember. Or cargo install ferrite-cli if you enjoy compiling.
features
Everything you actually reach for at 3 a.m., nothing you have to attend a webinar to understand.
Fleet-wide everything
Tail, grep, and count across 2 hosts or 2,000 with one command. Ferrite fans out over SSH, streams back over a multiplexed channel, and merges results in timestamp order. No agents to install, no agents to patch.
Rude amounts of speed
SIMD-accelerated matching built on the same engine family as ripgrep. Roughly 2.1 GB/s per core on plain text, and it skips binary files instead of printing the ghost of your terminal.
Structured or feral
Auto-detects JSON, logfmt, syslog, and multi-line Java stack traces. Pretty-prints them into aligned, severity-colored columns. Handles whatever format your 2019 intern invented, mostly.
Single static binary
4.7 MB, no runtime, no daemon, no JVM warming up like an old diesel. Drop it on a box from 2013 and it runs. Delete it and it is gone. Revolutionary, we know.
Time travel included
Query the past with human units: --since 2h, --between "09:00..09:15". Ferrite seeks compressed rotated logs (gz, zst) directly, so yesterday's incident is one flag away, not one S3 restore away.
Counts, not vibes
ferrite stats turns matches into per-host histograms and top-K tables right in your terminal. Find out which node is emitting 94% of the 500s before your dashboard finishes loading.
benchmarks
Searching a 24 GB nginx corpus for status=5\d\d on a 16-core box. Reproduce it yourself: the harness is in the repo under bench/.
Numbers from our fixture fleet, 2026-06. ripgrep is measured on a single host because it is a single-host tool, and an excellent one. We stand on its shoulders and its regex crate.
quickstart
Ninety seconds from install to answers. No config file required until step three tempts you.
Install the binary
The script detects your platform, verifies the checksum, and puts ferrite in ~/.local/bin. Read it first if you like. We would.
$ curl -fsSL https://ferrite.dev/install.sh | sh $ ferrite --version ferrite 1.7.3 (phosphor)
Define a fleet
A fleet is just a named list of SSH targets. Import your existing ~/.ssh/config or add hosts by hand. Ferrite uses your keys and agent, nothing new to rotate.
$ ferrite fleet add prod web-{01..08} api-{01..06} # or pull matching hosts straight from ssh config: $ ferrite fleet import --match 'prod-*' --name prod
Search like you mean it
Live tail with a filter, historical grep with time bounds, or stats when you need a number for the postmortem.
$ ferrite tail --fleet prod "checkout" $ ferrite grep --fleet prod 'timeout' --since 2h --level warn+ $ ferrite stats --fleet prod 'status=5\d\d' --by host --since 24h
faq
Formatted as a man page because you were going to pipe it to less anyway.
- Is this a replacement for my log platform?
- No. Ferrite reads logs where they already live: on your servers. If you need year-long retention, alerting, and dashboards for executives, keep your platform. If you need an answer in the next forty seconds, use Ferrite. Most teams use both and stop paying to ingest debug logs nobody queries.
- Does it install anything on my servers?
- Nothing persistent. Ferrite pushes a small helper over the existing SSH connection, runs it for the duration of your command, and removes it. Your servers end the session exactly as they started, which is more than we can say for most vendors.
- What about Kubernetes?
ferrite tail --k8s prod-cluster "checkout"speaks to the API server directly and merges pod logs the same way it merges host logs. Label selectors work where you would expect. CRDs were not harmed.- How does it handle secrets in logs?
- Built-in redaction patterns for common token and key formats are on by default (
--no-redactto disable, at your own postmortem). Nothing is ever sent anywhere except from your servers to your terminal, over your SSH. - Is it actually free?
- MIT licensed, no tiers, no seat math, no "contact sales" button hiding the price. We sell a hosted fleet-history product for teams who want it. The CLI stays free because a grep with a login page is not a grep.
- Why is it called Ferrite?
- Iron oxide: the stuff of rust and of magnetic tape. Logs, rust, storage. We also just liked it. Naming is one of the two hard problems, along with cache invalidation and off-by-one errors.