Stop Losing Your Streaming Logs: Grep Data That's Already Gone By

You know the pain: you're tailing logs from a Kubernetes pod or a live service, you see an error flash by, and by the time you've typed the grep pattern to filter for it, the relevant lines are already buried under hundreds of new ones. You could pipe everything to a file and grep that, but that kills the real-time flow. What if you could have both live filtering and a way to rewind through recent output without restarting your whole pipeline? That's exactly what sig is built for.

sig is an interactive grep tool for streaming data. It's a single binary that sits between your data source (a pipe, a command, or a file) and your terminal, letting you search through live output in real time. The clever part is that it doesn't just let you search forward—it gives you a way to go back and re-examine data that's already passed, without killing your process or losing your place.

What It Does

sig is a terminal-based interactive grep utility written in Rust. You feed it data through a pipe, or you give it a command to run with the --cmd flag. Once it's running, you get a standard filter input at the bottom of your terminal. As you type, the displayed results update in real time, filtering the incoming stream.

The core architecture is straightforward, but the design decisions around streaming are where it gets interesting. When you pipe data into sig, it processes it as a continuous stream. But here's the catch: with a pipe, there's no way to seek backward. Once data has scrolled past your filter, it's gone unless you have a way to re-run the source.

That's where the --cmd flag comes in. Instead of piping data, you specify a command like sig --cmd "stern --context kind-kind etcd". Now sig executes that command itself. If you're fine-tuning your search and miss something, you can hit Ctrl+R to re-execute the command and get a fresh batch of data to filter through. This solves the fundamental problem of live data: it doesn't wait for you to get your search right.

For static input, like cat README.md | sig, the behavior is different. Once the input reaches EOF, sig automatically switches to what it calls "archived mode." It keeps the latest N entries of streaming data in memory, and you can toggle into a mode where you're grepping through that saved buffer. It's similar to ugrep's -Q option, but built into the streaming workflow.

Why It's Cool

The main appeal here is that sig addresses a real, annoying gap in the typical developer workflow. Most grep tools are either purely static (you grep a file, get results, done) or purely streaming (you tail a log and filter forward). sig bridges that gap with a few genuinely thoughtful features.

• Rerunnable commands solve the "missed it" problem. The --cmd flag with Ctrl+R is the killer feature. If you're watching live logs and you see something interesting scroll by, you don't have to reconstruct the pipeline or wait for the next occurrence. You just re-run the command and get a fresh shot at it. This is huge for debugging flaky issues or just catching something you weren't fast enough to filter for.

• Archived mode gives you a rewind button. For streaming data from a pipe, there's no seeking. sig sidesteps that by keeping a rolling buffer of the latest N entries. Hit Ctrl+F, and you're now grepping through that saved history. It's not a full log file, but it's enough to catch what just happened. And for static files, it switches to this mode automatically at EOF, so you get the same interactive experience whether your data is alive or dead.

• It's a single, easy-to-install binary. You can get it via Homebrew, Cargo, Arch Linux's pacman, Nix flakes, or even x-cmd. No daemons, no config files, no server components. It's a focused tool that does one thing well.

• The keymap is intuitive if you know basic terminal shortcuts. Ctrl+S to pause/resume stream ingestion is a nice touch—you can freeze the output while you think, then resume without missing anything. Ctrl+A and Ctrl+E for cursor movement are familiar from bash. The learning curve is minimal.

How to Try It

Getting started is a matter of installing the binary and pointing it at your data. The quickest path is probably Homebrew or Cargo:

# Homebrew
brew install ynqa/tap/sigrs

# or Cargo
cargo install sigrs

If you're on Arch Linux, you can pacman -S sig. Nix users can run it directly with nix run github:ynqa/sig or add it to a flake.

Once it's installed, the simplest test is to pipe a static file through it:

cat README.md | sig

You'll see the interactive filter appear. Type something, watch the results narrow down, and when you hit EOF, notice how it switches to archived mode so you can still search through what you've already seen.

For the streaming use case, try it with a live command:

sig --cmd "stern --context kind-kind etcd"

Run it, let some output accumulate, then hit Ctrl+R to re-run the command and Ctrl+F to enter archived mode. You'll get a feel for how the two modes complement each other.

Final Thoughts

sig isn't trying to replace grep or jq or any of the heavy hitters. It's a focused tool for a specific pain point: interactive filtering of live data without losing your ability to look backward. If you spend a lot of time tailing logs from services or debugging with streaming output, it's worth a try. The archived mode and rerunnable commands are genuinely useful ideas that fill a real gap. It's not flashy, but it's the kind of tool that quietly makes your daily workflow less frustrating. Give it a spin the next time you're staring at a wall of scrolling logs.

Follow @githubprojects for more developer tools and open source projects.