Loghound reads the access logs your web server already writes, correlates them with an optional JavaScript beacon, and keeps what it learns in two Opensolr indexes it provisions for you. It exists for two reasons and it is narrow on purpose.
It needs an Opensolr account, because it creates and manages those two indexes itself. Why an account is required.
It is a serious bot detector, not a User-Agent blocklist
Every analytics tool says it filters bots. What it actually does is match a list of strings like Googlebot against the User-Agent header, which catches precisely the crawlers that were polite enough to identify themselves, and nothing else.
Modern scraping does not look like that. It looks like headless Chrome on rotating residential proxies: a real browser engine, running your JavaScript, fetching your CSS and images, presenting an ordinary Windows Chrome User-Agent, arriving from a different consumer ISP on every request. From inside any single plane of observation it is indistinguishable from a person, which is why essentially every analytics product counts it as one.
It measures real time on site
When a conventional product reports “average time on page: 4m 12s”, it is usually reporting how long a tab existed — not how long it was visible, and not how long anybody was looking at it. Loghound keeps four separate numbers and never averages them together, and because the beacon flushes on pagehide it can measure the last page of a visit, which log-only tools structurally cannot see.
Everything else here — the charts, the geography, the facets — is table stakes that a dozen tools already do well. If a design decision would trade away accuracy on these two for convenience somewhere else, the answer in this project is no.
Three processes and two indexes. A daemon tails, parses, enriches, sessionises and indexes. A timer every sixty seconds closes sessions, merges the beacon data, computes the fingerprint clusters and scores. A daily timer deletes past the retention window. The panel reads the sessions index.
Figure 1 — the pipeline. Your log files are only ever read; the public beacon endpoint never touches Solr, so the Solr credentials stay out of the most exposed path in the product; and the panel queries the small sessions index rather than the large hits one.
- It blocks nothing. It is not a firewall; deciding what to do about what it finds is your job, which is why every verdict comes with its reasons.
- It is not product analytics. No funnels, goals, A/B tests or revenue attribution.
Who it gets wrong and what it cannot see: False positives. How a careful, well-funded scraper passes: Evasion. What the panel does not claim: Known limitations.
It works alongside whatever you already run: it reads log files your web server writes anyway, and the beacon is independent of any other analytics on the page.
Start here
- Documentation home
- What Loghound is
- The three-plane model
- Requirements