Loghound reads the access logs your web server already writes, correlates them with an optional JavaScript beacon, and keeps what it learns in two Opensolr indexes it provisions for you. It exists for two reasons and it is narrow on purpose.
Loghound does not merely read and write its two indexes, it owns them: it creates them, uploads their configsets, reloads the cores and verifies them, and later trims them against your plan. There is no bring-your-own-Solr path, because on a Solr it does not administer it can do none of that. Why an account is required has the full reasoning.
It is a serious bot detector, not a User-Agent blocklist
Every analytics tool says it filters bots. What it actually does is match a list of strings like Googlebot against the User-Agent header, which catches precisely the crawlers that were polite enough to identify themselves, and nothing else.
Modern scraping does not look like that. It looks like headless Chrome on rotating residential proxies: a real browser engine, running your JavaScript, fetching your CSS and images, presenting an ordinary Windows Chrome User-Agent, arriving from a different consumer ISP on every request. From inside any single plane of observation it is indistinguishable from a person, which is why essentially every analytics product counts it as one.
It measures real time on site
When a conventional product reports “average time on page: 4m 12s”, it is usually reporting how long a tab existed — not how long it was visible, and not how long anybody was looking at it. Loghound keeps four separate numbers and never averages them together, and because the beacon flushes on pagehide it can measure the last page of a visit, which log-only tools structurally cannot see.
Everything else here — the charts, the geography, the facets — is table stakes that a dozen tools already do well. If a design decision would trade away accuracy on these two for convenience somewhere else, the answer in this project is no.
Three processes and two indexes. A daemon tails, parses, enriches, sessionises and indexes. A timer every sixty seconds closes sessions, merges the beacon data, computes the fingerprint clusters and scores. A daily timer deletes past the retention window. The panel reads the sessions index.
Figure 1 — the pipeline. Your log files are only ever read; the public beacon endpoint never touches Solr, so the Solr credentials stay out of the most exposed path in the product; and the panel queries the small sessions index rather than the large hits one.
An honest limitations section, near the top rather than buried, because a bot detector that oversells itself is worse than none — you stop looking at it. False positives and evasion are the long versions.
- It blocks nothing. It is not a firewall. It issues no challenges, writes no rules and rate-limits nobody. Deciding what to do about what it finds is your job, which is exactly why every verdict ships with its reasons attached.
- A well-funded, careful scraper wins. A real non-headless browser, a genuinely unique and self-consistent header fingerprint per session, synthesised human-like input, no reused exit address — that is classified as human. Everything here raises the cost of scraping; none of it makes scraping impossible.
- Privacy-conscious humans get flagged. Ad blockers, NoScript, Brave shields and Lockdown Mode all stop the beacon, and from the log that looks exactly like a non-JS client.
- Traffic that never reaches your origin does not exist. A request served from a CDN edge or from Varnish in front of you writes no origin log line. If you run a CDN, you are analysing your cache misses.
- It is not product analytics. No funnels, no goals, no A/B tests, no revenue attribution, no cohort retention.
- Low-and-slow scrapers are below every threshold by construction. One page, one address, once a day. The fingerprint signal needs a fleet to detect a fleet.
It also works alongside whatever you already run: it reads log files the web server is writing regardless, and the beacon is independent of any other analytics on the page.