Log Parser
Turn log lines into structured rows with a regex — named capture groups become columns.
Pattern
Use named groups like (?<ip>\S+) to name columns. One log line becomes one row.
Examples
Parsing an Apache access line
Preset: Apache/Nginx CLF
127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326ip=127.0.0.1 user=frank
timestamp=10/Oct/2000:13:55:36 -0700
request="GET /apache_pb.gif HTTP/1.0"
status=200 bytes=2326Named capture groups in the preset (ip, user, timestamp, request, status, bytes) become columns automatically — no mapping step required.
About this tool
The Log Parser applies a regular expression to each line of a log file and collects the matches into structured rows. The key idea is named capture groups: write (?<ip>\S+) and an ip column appears automatically — there is no separate column-mapping step. Built-in presets for the Apache/Nginx Common Log Format and RFC 3164 syslog get you started by pasting a few access lines and immediately reading them as a table.
The result view switches between a table, a JSON array, and RFC 4180 CSV with one-click copy. Lines that do not match are counted and listed separately so you can tighten the pattern, and unmatched lines are grouped rather than silently dropped. Everything runs in your browser — no log data ever leaves your machine.
How to use
Paste lines or load a preset
Choose the Apache/Nginx Common Log Format or RFC 3164 syslog preset, or start with your own pattern and paste in the log lines.
Write the pattern with named groups
Use (?<name>…) capture groups so each named group becomes a column; unnamed groups fall back to group_1, group_2, …
Review and export
Inspect the table, check which lines did not match, then copy the JSON array or RFC 4180 CSV into your pipeline.
Use cases
Analyze web access logs
Parse Nginx or Apache access lines into rows, then count status codes or find the paths serving 404s and slow responses.
Feed a log pipeline
Turn ad-hoc grep output into well-structured CSV or JSON for a log aggregator, spreadsheet, or quick script.
Extract fields from application logs
Pull IPs, levels, timestamps, and messages out of arbitrary app logs with one regex instead of multiple splits.
Common mistakes
Mistake:Using unnamed capture groups.
Fix:Name the groups — (\S+) yields a meaningless group_1 column, while (?<ip>\S+) produces a labeled ip column.
Mistake:Forgetting to escape regex metacharacters.
Fix:Dots, slashes and brackets in log formats must be escaped (or matched with \S+ / \d+) so the pattern matches the literal line.
Mistake:Assuming every line will match.
Fix:Unmatched lines are counted and listed separately — inspect them and tighten the pattern rather than ignoring the gap.
Frequently asked questions
Related guides
A Practical PromQL Guide: Selectors, Rates, and Aggregations
Compose Prometheus queries with confidence — metric selectors, label matchers, rate/increase windows, and sum by / topk aggregations, with the mistakes that break a query.
Log Parsing with Regex: Turn Lines into Rows
Turn raw Apache, Nginx, and syslog lines into structured data using named capture groups, and export the result as table, JSON, or CSV.
References & standards
Related tools
Binary Text Translator
Convert text to binary or hex bytes and decode it back
Case Converter & Text Formatter
Convert text between 14 different case formats including camelCase, snake_case, kebab-case with batch processing and advanced options
Character Frequency Analyzer
Count character, letter and word frequencies for text analysis
Find and Replace Text
Find and replace text with optional regex, case, and multiline matching
HTML to Markdown Converter
Paste HTML and get clean Markdown. Configurable heading style, bullet marker, and code block style — all processed locally in your browser.
Markdown Linter
Check Markdown for common style problems — skipped heading levels, trailing whitespace, hard tabs, missing space after #, trailing heading punctuation, long lines, and stacked blank lines