November 2025

SQLite as a Log Store: One Year Later

A year ago we replaced JSONL request logs with WAL-mode SQLite. We spent more time writing jq pipelines than it would take to write SQL.

Write Performance

WAL mode on SSD: ~80,000 single-row inserts/sec. Our peak: 200 req/s. Per-request overhead: ~0.3ms.

Query Patterns

"All requests from this IP," "User-Agent distribution for this fingerprint" — went from multi-line jq to straightforward indexed SQL.

Would We Do It Again?

Unconditionally yes. For single-server logging, SQLite is the right answer.