Log parser

How to use it

1. Paste a log excerpt or open a local .log / .txt file. Parsing starts immediately — there is no Run button — and each line is checked for JSON, logfmt, web access, syslog and timestamp/level-led text in that order.
2. Read the summary first: time range, level counts, exceptions, detected formats and the most common field keys. The summary always covers every event.
3. Click a level chip or type in the search box to narrow the list; the two combine. Click any row to expand the full message, all fields, the exception stack and the raw line, then copy or download the filtered events as JSON.

Example

2026-10-20T13:55:36.123Z INFO [gateway] request received path=/api/orders user_id=4821
{"@timestamp":"2026-10-20T13:55:37.004Z","level":"error","service":"payment","message":"Charge failed","order_id":"A-1042","user_id":4821}
127.0.0.1 - alice [20/Oct/2026:13:55:38 +0000] "POST /api/orders HTTP/1.1" 502 187 "-" "curl/8.5.0"
2026-10-20 13:55:40,512 ERROR [order-service] Unhandled exception
java.lang.IllegalStateException: gateway timeout
    at com.acme.Order.submit(Order.java:42)

Events: 4 · Lines: 6
Time range: 2026-10-20T13:55:36.123Z → 2026-10-20T13:55:40.512 (mixed zones)
Levels: info 1 · error 3
Exceptions: 1
Formats: JSON 1 · Web 1 · Text 2
Fields: path 2 · user_id 2 · bytes 1 · client 1 · method 1 · order_id 1 · protocol 1 · status 1

The JSON line is one event; the Java class line and its stack are continuation lines of the ERROR event above them. The text line with no zone is compared as a literal clock time, which is why the range is labelled mixed zones. HTTP 502 counts as error; the status code stays visible as the original level.

Rules, limits and known issues

• Detection is line by line and ordered: JSON (one object per line), logfmt (at least two key=value pairs), Apache/Nginx common or combined access logs, syslog RFC 5424/3164, then text whose line starts with a supported timestamp or level. Anything else is kept as a plain event — no line is dropped.
• Only unambiguous timestamps are normalised: ISO 8601, year-first dates, Apache access-log times and Unix seconds or milliseconds. 03/04/2026, date-only values and year-less syslog keep their original text and have no normalised time.
• Fractions of a second are truncated to milliseconds, never rounded. Offsets are preserved; times without an offset are compared as literal clock times and the summary says naive or mixed.
• Levels come from a fixed vocabulary (English plus Chinese and Arabic words), pino/bunyan numbers, syslog PRI/severity, or HTTP status (5xx error, 4xx warn, everything else info). A line with no recognised level is unknown, not info.
• Indented lines, stack frames, Traceback, Exception in thread and Caused by lines attach to the previous event; a blank line ends the stack. This is a heuristic — an unsupported multi-line format may need a blank line between records.
• Exceptions are recognised from class names ending in Exception, Error or Throwable. The deepest Caused by wins. Frames are not parsed, root causes are not ranked beyond that, and no AI service is called.
• The list renders at most 200 matching events. Counts, the summary, copy and download always cover every match, and the list says when it is truncated.
• Hard input limit: 5,000,000 characters. Above 500,000 characters parsing still works, with a longer debounce. A single line longer than 200,000 characters is kept as plain text.
• JSON arrays and pretty-printed multi-line JSON are not supported: only one object per line. Invalid JSON, comments and trailing commas fall back to plain text rather than being repaired.
• Nothing is uploaded, stored or put in the URL. Files are read locally with the browser File API, and copy/download only happen when you click the button.

Related tools

Once the log is structured, these are the usual next steps.