Log LionEnterprise extensions
Your logs, wherever your services keep them
Your services log to containers, search platforms and observability tools, not only to files. Log Lion's Enterprise extensions open those as logs in the same window as your files, with the same filters, colors, timeline and analysis tools. Built and signed by Regal Logic, and included with every Teams and organizations license. Docker is also included with Personal, from the Microsoft Store.
The extensions
Select a card to see how each integration works.
-
Docker
Every container in a compose project, merged by time into one view and followed live, with each container in its own color.
- Docker Desktop
- Docker Engine
- Compose
- Remote engines
- Also in Personal
Docker in Log Lion
- Connects
- To the Docker Engine API, the way the
dockercommand does: this computer's engine, or a remote one throughDOCKER_HOST. - Reads
- A whole compose project or the containers you pick, history first and then new lines as they come.
- Understands
- JSON and logfmt lines open as fields. Give a service a pattern, or spell out coded values, and its lines get real columns.
- Saves
- A .docker file that opens the same project and view again, for you or your team.
-
Splunk
Events from Splunk Enterprise or Splunk Cloud, beside the files and containers they came from, without writing SPL by hand.
- Splunk Enterprise
- Splunk Cloud
- REST API
Splunk in Log Lion
- Connects
- To Splunk's REST API on the management port, with an authentication token (single sign-on accounts too) or a user name and password.
- Filters
- Your Log Lion filter becomes part of the Splunk search, so it covers the whole time range, not only what has been fetched.
- Follows
- Oldest events first, each page shown as it arrives, then new events live, late arrivals included.
- Saves
- A .splunk file naming the deployment, sign-in and search. It decodes each sourcetype's lines your way.
-
Grafana Loki and ClickHouse
Logs in Loki or ClickHouse, read through a Grafana MCP server. Sign in to Grafana in your browser; no database credentials to hand out.
- Grafana
- Loki
- ClickHouse
- OpenTelemetry
Grafana MCP in Log Lion
- Connects
- Through a Grafana MCP server to the datasources Grafana already has, with Grafana's own sign-in and permissions.
- Filters
- Translated to LogQL for Loki or SQL for ClickHouse and run on the server, across the whole time window.
- Understands
- OpenTelemetry's storage layouts for both backends, and Loki's labels, are one setting. Any other table is described column by column.
- Saves
- A .gmcp file per service or environment, opened like any log.
-
New Relic
Logs stored in New Relic, queried with NRQL and shown with the rest, so an incident reads as one timeline instead of several browser tabs.
- NerdGraph
- NRQL
- US, EU and FedRAMP
New Relic in Log Lion
- Connects
- To NerdGraph, New Relic's API, with a user key of someone allowed to query the account. An ingest key can send logs but not read them, so it isn't enough.
- Filters
- Become NRQL conditions, so New Relic returns only the matching logs from the whole time range.
- Follows
- Counts the matches first, so the progress bar is real, then pages oldest first and keeps up with new logs.
- Saves
- A .newrelic file with the account, region and query.
-
OpenObserve
Logs in OpenObserve, on your own servers or in OpenObserve Cloud, searched with SQL and followed live.
- Open source
- Enterprise
- OpenObserve Cloud
OpenObserve in Log Lion
- Connects
- To OpenObserve's HTTP API with a user's email and password or a service account's token. The dialog lists your organizations and streams.
- Filters
- Become SQL conditions run by OpenObserve, so a search covers the whole time window.
- Understands
- Time, level, host, service and message become columns. Name more fields as columns, or keep every field with its entry.
- Saves
- A .openobserve file with the server, organization and stream.
-
Don't see yours?
Tell us where your logs live: Elasticsearch, Datadog, CloudWatch, a database of your own. We plan by votes, so add yours.
Request an extension
Built for teams that run production
One view of an incident
Put a container's output, the Splunk events and the New Relic logs side by side, on one timeline, and see what happened in what order. No exports, no copying between tabs.
Filters run on the server
Write one Log Lion filter. Each extension translates it to SPL, LogQL, NRQL or SQL, so it searches the whole time range, and only what matches crosses the network.
Read-only, direct, and signed
Extensions only ever read. Log Lion talks straight to your services, with no Regal Logic servers in between. Regal Logic signs every extension, and Log Lion checks the signature before loading it.
Secrets stay secret
Passwords and tokens show as dots and are never written to disk. A connection file names an environment variable or a Windows Credential Manager entry instead.
Deploy only what you use
Each extension is its own feature in the signed Log Lion MSI. Install them all, or only the ones your teams need, from Intune, Configuration Manager or any deployment tool.
Each one saves its connections as small files. Put a team's .splunk or .newrelic files on a share, and everyone opens the same views with their own sign-in.
# everything, silently
msiexec /i LogLion-x64.msi /qn
# Log Lion with Splunk and New Relic only
msiexec /i LogLion-x64.msi /qn ^
ADDLOCAL=Complete,Ext_splunk,Ext_newrelic
# leave one out
msiexec /i LogLion-x64.msi /qn REMOVE=Ext_dockerFeature ids: Ext_docker, Ext_splunk,
Ext_grafana_mcp, Ext_newrelic, Ext_openobserve.
Need a platform we don't cover?
Ask for it on GitHub, where others can vote for it too, or email sales@regallogic.com about one built for your organization.
Docker, Splunk, Grafana, Loki, ClickHouse, New Relic and OpenObserve are trademarks of their respective owners, shown here to identify the products the extensions work with. Regal Logic is not affiliated with or endorsed by them.