📋 Log Parser

📐 Log format

Detected: {{ detectedFormat }}

📝 Log input

⚠️ {{ w }}

🎯 Preset query

{{ presetList.find(p => p.id === selectedPreset)?.description }}

🔎 Filter

Combine clauses with AND . Operators: = != ~ !~ > < >= <=.

📊 Aggregate

⬇️ Export

📑 Parsed entries ({{ filteredEntries.length }} / {{ entries.length }})

{{ f }} {{ sortDir === 'asc' ? '▲' : '▼' }}
{{ formatCell(entry[f]) }}
Paste log lines on the left to populate this table.

📊 Aggregate result

Enter a "Group by" field on the left to see distribution.
{{ g.key || '(empty)' }} {{ g.value }}
⚠️ {{ error }}

ℹ️ About Log Parser

What this parser does

Paste raw server logs into the input on the left and the tool parses them into a structured table with named columns: IP, status code, URL, timestamp, user-agent, and any custom field present in the source format. From there you can filter, sort, aggregate, and export the result as JSON, NDJSON, CSV, or TSV — entirely in your browser.

Supported formats: Apache Common and Apache Combined log formats, nginx default log_format combined, RFC 3164 and RFC 5424 syslog, JSON Lines (one JSON object per line), and the systemd journal export blank-line-separated key=value format. An automatic detector picks the most likely format when you select Auto-detect.

Format quick reference

  • Apache Common — IP ident user [timestamp] "method uri proto" status size.
  • Apache Combined — Common + "referer" "user-agent".
  • nginx access — structurally identical to Apache Combined.
  • syslog RFC 3164 — <PRI>Mmm dd HH:MM:SS hostname tag[pid]: message.
  • syslog RFC 5424 — <PRI>VERSION TS HOST APP PROC MSGID [SD] MSG.
  • JSON Lines (jsonl) — one JSON value per line; non-object values appear under a value column.
  • systemd journal export — blank-line separated records, __REALTIME_TIMESTAMP=…, MESSAGE=…, etc.

Filter mini-language

Compose clauses with AND (uppercase, spaces required):

  • field=value — exact match (string-equal).
  • field!=value — not equal.
  • field~regex — regex match (case-insensitive).
  • field!~regex — regex non-match.
  • field>n, field<n, field>=n, field<=n — numeric comparison.

Example: status=404 AND ip~^10\. selects 404 responses from the 10.0.0.0/8 private block.

Aggregate metrics

  • count — number of entries per bucket.
  • sum — total of a numeric field (size, response bytes).
  • avg — average of a numeric field.
  • min / max — extremes of a numeric field.

Use cases

  • Top traffic sources — group Apache/nginx logs by IP to find the noisiest clients.
  • 404 audits — filter for HTTP 404 and aggregate by URL to find broken links and bots.
  • Server-error triage — filter for 5xx responses by URL or by hour to localize problems.
  • SSH-brute-force monitoring — load auth.log as syslog RFC 3164, filter by tag sshd and the message Failed password.
  • journalctl post-mortems — paste journalctl -o export output, filter on SYSLOG_IDENTIFIER and PRIORITY.
  • Application JSONL logs — parse structured JSON logs from modern services without leaving the browser.

Source references

Privacy

The interactive parser runs entirely in your browser — pasted log lines never leave the page. The public API endpoint processes submitted text on the server. Avoid sending raw production logs through the API if they contain authentication tokens, session identifiers, or other secrets.

API Usage Example:

POST /api/tools/linux/log-parser
Content-Type: application/json

{
    "text": "192.168.1.1 - - [10/Oct/2024:13:55:36 +0000] \"GET /index.html HTTP/1.1\" 200 1234 \"-\" \"Mozilla/5.0\"",
    "format": "auto",
    "operation": "parse"
}
Ready