Chris Collins

Tools · data

Log parser

Paste or drop logs (large files are streamed) — nginx/Apache, JSON lines, logfmt, syslog RFC 3164/5424, journald, Java with multi-line stack traces, Go zap/slog, Kubernetes CRI, CloudWatch — or write a grok pattern with the standard Logstash library; get field statistics, a zoomable time histogram, filter expressions, message templates (Drain), CSV/JSONL export, and the table in DuckDB lab or the data wrangler.

Added

Works with

How to use it

Logs are tables that nobody wrote down the schema for. This page works out the format, turns every line (or multi-line record) into fields, and then lets you count, filter and group them — without sending them anywhere.

How to use it

Paste lines or drop a file. Big files are read as a stream, so a few hundred megabytes is fine (the first million records are kept; .gz is unpacked in the page). The format is detected from the first few hundred lines:

  • nginx and Apache access logs (combined or common; extra nginx fields after the user agent are kept as key=value pairs), Apache and nginx error logs

  • JSON lines — with the time, level and message found whatever they are called: Go zap and slog, Spring Boot / Elastic ECS, pino, bunyan, journald JSON, Docker’s json-file driver (whose log field is parsed again)

  • logfmt (Go slog’s text handler, logrus, Heroku)

  • syslog RFC 3164 (with or without <PRI>, also journalctl short and short-iso output) and RFC 5424 with structured data; facility and severity decoded

  • journald export format (journalctl -o export)

  • Java: Spring Boot’s default pattern, Logback and Log4j2 layouts, Python’s logging default, java.util.logging’s two-line records — with stack traces (`at …, Caused by:, …​ 5 more) joined to their record and the exception and root cause pulled out

  • Go zap console encoder

  • Kubernetes container logs in the CRI format (time stdout F message, partial P lines joined) and CloudWatch Logs exports (aws logs filter-log-events JSON, Logs Insights CSV, aws logs tail) — the message inside is detected and parsed again, and Lambda REPORT lines become numbers

For anything else, open the grok / regex builder: pick patterns from the standard Logstash library (search it, hover for the expansion), or press Suggest to get a starting pattern from a sample line, and watch the fields appear on the sample lines as you type. %{NUMBER:bytes:int} makes a number. A plain JavaScript regular expression with named groups works too. Copy as Logstash filter gives you the pattern in Logstash syntax.

Then:

  • Filter with expressions: status >= 500 and path ~ "^/api", level >= warn, -healthz, exception:Timeout, user in (alice, bob), has(trace_id), time > "2026-10-29T06:15", /wp-(login|admin)/. A bare word searches the whole line. Click the level chips to narrow further.

  • The time histogram stacks records by level; drag across it to zoom in.

  • Fields shows, for every field, how often it is present, how many distinct values it has, the top values (click one to filter on it), and for numbers the percentiles and a histogram.

  • Clusters groups similar messages into templates with the variable parts as <*> — "connection refused to <IP>" across thousands of lines becomes one row with a count. It uses Drain (He et al., ICWS 2017).

  • Export the filtered records as CSV or JSONL, or hand them straight to DuckDB lab (as a JSONL file, to query with SQL) or the data wrangler (as a CSV table, to clean and reshape).

How I checked it

The grok engine translates Logstash’s Oniguruma patterns to JavaScript (atomic groups, \h, POSIX classes, inline flags). I ran the same 15 patterns over 50 lines through Logstash 8.15.3’s own grok filter in its Docker image and the fields here are identical, including the failures; a quoted string that never closes fails in milliseconds rather than hanging. The format parsers are tested on logs I generated for this page: nginx and Apache in a container, syslog sent by logger over UDP, journald’s export and JSON output, Spring Boot 3.5 and Log4j2 with real exceptions, Go slog and zap. The CRI and CloudWatch samples are written by hand in their documented formats.

Related: regex tester, JSON workbench, Linux triage (dmesg and the 60-second checklist), strace viewer, CSV tools.

Browser support

Any current browser. Streaming needs File.stream() and TextDecoderStream (all current browsers).

Privacy

The logs are read in this page and never uploaded. Your last grok pattern, filter, chosen columns and example are remembered in this browser’s local storage. The hand-off to DuckDB lab or the data wrangler goes through this browser’s IndexedDB and is deleted when the other page reads it.

The grok pattern library is logstash-patterns-core 4.3.4 by Elasticsearch and contributors, under the Apache License 2.0, shipped with this page as log-parser-grok.js.

Runs entirely in your browser; nothing you type leaves this page.