Multi-Format Log Parser

Paste or drop logs in JSON, JSONL, CSV, key-value, CEF, LEEF or syslog and get parsed, filterable, countable fields - detected automatically, processed in your browser.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop log files

JSON, JSONL, CSV/TSV, key=value, CEF, LEEF, syslog, W3C/IIS, Apache/Nginx or Windows event XML - up to 256 MB, parsed in a background worker in your browser.

Or paste log lines

Format

Timestamps without an offset are in

One parser for the formats you actually get

Logs rarely arrive in the format you want. This parser looks at a sample of the lines, names the format it found and says why. It then reads every record into named fields:

nested JSON is flattened to dotted names such as userIdentity.arn;
CEF headers and extensions keep values that contain spaces;
RFC 5424 structured data becomes sdid.param fields;
W3C files follow their own #Fields line.

Lines that do not parse are kept as plain messages and listed, so nothing disappears silently.

Filter, count, and see the shape of the data

Every field gets a count of how often it is present, how many distinct values it has, and its top values. Click a value to filter on it. The filter box takes plain words, field=value with * wildcards, field!=value, field~regex, numeric comparisons such as status>=500, field? for "present", and a leading - to exclude. All terms must match. The timeline shows event counts over time in UTC. A table of hundreds of thousands of rows stays responsive because only the visible rows are drawn.

Time zones, stated rather than guessed

Timestamps with an explicit offset are converted exactly. For those without one, choose the zone they were written in; the default is UTC. Syslog lines have no year, so the current year is assumed and the note says so. W3C logs are always UTC by specification.

Frequently asked questions

Is my log uploaded?

No. Files are read by your browser and parsed in a Web Worker on this device. Nothing is sent to our server, to analytics or to an AI service, and closing the tab discards everything.

How large a file can it handle?

Files up to 256 MB can be read, and up to 500,000 records are loaded for analysis; beyond that the total is still counted. Parsing runs in the background and can be cancelled at any time.

What if detection picks the wrong format?

Choose the format yourself from the list. The detection reason is shown so you can see what it keyed on.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.