Log Analyzer

When an incident starts, the first questions are usually the same: which status codes are we returning, since when, for which URLs and from which clients? This analyzer answers them from a raw log in seconds, without installing GoAccess, setting up an ELK stack or writing an awk pipeline. It recognises the Nginx and Apache combined and common log formats (with an optional request time at the end of each line), JSON lines from structured loggers such as pino, bunyan, zap, logrus, Serilog or the Docker json-file driver, and plain text application logs with levels like ERROR, WARN and INFO and ISO 8601 or syslog timestamps.

Format detection looks at the first hundred non-empty lines; switch the format manually if a log mixes styles. In plain text logs, lines without a timestamp or level (stack traces, wrapped messages) are attached to the entry above them, so an exception counts once. Error messages are grouped after numbers, UUIDs, IP addresses, e-mail addresses and long hex strings are replaced by placeholders, so "timeout after 3012 ms for user 81" and "timeout after 2950 ms for user 7" land in the same bucket. Times are shown in UTC; timestamps without a zone are assumed to be UTC, and syslog timestamps, which have no year, are given the current year.

Files of 50 MB and more are parsed in chunks so the page stays responsive, and the table renders the first 500 matching entries at a time while the statistics always cover every matching line. Click a bar in the timeline to zoom into that interval, or click an item in a top-10 list to filter on it. A filter wrapped in slashes, such as /POST .*\/login/ or /timeout|refused/i, is treated as a regular expression; build and debug complex patterns in the regex tester.

Related tools: convert epoch values from JSON logs with the Unix timestamp converter, check whether suspicious client IPs belong to the same network with the subnet calculator, turn the outage you just found into an uptime percentage with the SLA & uptime calculator, and use the peak requests per second from the timeline in the throughput estimator.