Nesso

nesso (/ˈnɛs.so/, NESS-oh) is Italian for "link, connection" — it finds the connection between log lines by meaning, not just by keyword.

Semantic log search. grep for meaning: find the log lines you're looking for even when the words differ. Offline, one binary.

Semantic grep for logs, fully offline, no server, no cloud, no API keys, Apache-2.0.

Demo

The log does not contain the query.

nesso grep "the disk is full" app.log -k 3

line 869: 0.4736: Oct 18 06:13:11 web-02 app[4900]: write /var/lib/app/queue.db: No space left on device
line 1494: 0.4694: Oct 22 17:08:04 web-02 app[7918]: write /var/lib/app/queue.db: No space left on device
line 3762: 0.4677: Oct 24 23:39:07 web-02 app[2888]: write /var/lib/app/queue.db: No space left on device

nesso index -o app.nesso app.log

Indexed 5000 chunks into 'app.nesso'.

nesso search "the disk is full" -i app.nesso -k 3

--json on grep and search prints one JSON object per match. The keys, in order, are schema_version, rank, source, kind, line, score, text, and occurrences. schema_version is 1. kind is line or element. score is the shortest decimal that reads back as the same value. Bytes that are not UTF-8 in source or text are replaced with U+FFFD. Errors, warnings, and counts stay on stderr. With nothing to rank, stdout is empty and the command exits 1. Text output is unchanged. index does not accept --json.

line 869: 0.4736: Oct 18 06:13:11 web-02 app[4900]: write /var/lib/app/queue.db: No space left on device
line 1494: 0.4694: Oct 22 17:08:04 web-02 app[7918]: write /var/lib/app/queue.db: No space left on device
line 3762: 0.4677: Oct 24 23:39:07 web-02 app[2888]: write /var/lib/app/queue.db: No space left on device

Install

Ubuntu 26.04+ (glibc 2.43+), amd64 or arm64. The package includes the MiniLM model.

curl -fL -o nesso_0.2.1_amd64.deb \
  https://github.com/lorenzocaprari/nesso/releases/download/v0.2.1/nesso_0.2.1_amd64.deb
sudo apt install ./nesso_0.2.1_amd64.deb

curl -fL -o nesso_0.2.1_arm64.deb \
  https://github.com/lorenzocaprari/nesso/releases/download/v0.2.1/nesso_0.2.1_arm64.deb
sudo apt install ./nesso_0.2.1_arm64.deb

ghcr.io/lorenzocaprari/nesso includes the model at /usr/share/nesso (NESSO_MODEL_DIR). The entrypoint is nesso. Mount the log directory:

docker run --rm -v "$PWD:/data:ro" -w /data ghcr.io/lorenzocaprari/nesso:v0.2.1 \
  grep "the disk is full" app.log

Verify a download

nesso_0.2.1.intoto.jsonl covers the .deb packages and the SPDX SBOMs. SHA256SUMS lists every release file. The image attestation is stored on the manifest-list digest in GHCR.

curl -fL -o nesso_0.2.1_amd64.deb \
  https://github.com/lorenzocaprari/nesso/releases/download/v0.2.1/nesso_0.2.1_amd64.deb
curl -fL -o nesso_0.2.1.intoto.jsonl \
  https://github.com/lorenzocaprari/nesso/releases/download/v0.2.1/nesso_0.2.1.intoto.jsonl
curl -fL -o SHA256SUMS \
  https://github.com/lorenzocaprari/nesso/releases/download/v0.2.1/SHA256SUMS

sha256sum --ignore-missing -c SHA256SUMS

slsa-verifier verify-artifact nesso_0.2.1_amd64.deb \
  --provenance-path nesso_0.2.1.intoto.jsonl \
  --source-uri github.com/lorenzocaprari/nesso \
  --source-tag v0.2.1

digest="$(docker buildx imagetools inspect --format '{{index .Manifest.Digest}}' ghcr.io/lorenzocaprari/nesso:v0.2.1)"
slsa-verifier verify-image "ghcr.io/lorenzocaprari/nesso@${digest}" \
  --source-uri github.com/lorenzocaprari/nesso \
  --source-tag v0.2.1

slsa-verifier v2.7.1 or later. Signatures and the other provenance files are in Verifying a release.

More

• Usage
• Building
• Releases
• Verifying a release (from v0.2.0)
• Benchmarks
• Determinism
• Decisions
• Changelog, contributing, security, license