Access Log Parser

How to use

1. 1Paste log lines into the input box, or click Load sample log to see how Apache Combined output renders.
2. 2Pick a log format: Auto-detect handles mixed Apache and NGINX combined logs, or choose Apache Common, Apache Combined, or NGINX combined explicitly.
3. 3If your server uses a custom LogFormat, choose Custom and paste the format string (for example, $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent").
4. 4Review the summary cards for total bytes, status class distribution, and time range, and scan the top tables for the IPs, paths, and user-agent families generating the traffic.
5. 5Copy the parsed rows as CSV or JSON to move them into a spreadsheet or notebook. Lines that fail to match are listed at the bottom with the reason so you can adjust the format.

About this tool

Access Log Parser turns raw web server logs into a structured, searchable view in your browser. It speaks the formats that ship out of the box with Apache and NGINX: the Common Log Format (%h %l %u %t "%r" %>s %b), the Combined Log Format that adds Referer and User-Agent, and the NGINX combined preset built from $remote_addr, $time_local, $request, $status, $body_bytes_sent, $http_referer, and $http_user_agent. Auto-detect runs Combined, NGINX, and CLF against each line so a mixed paste does not need pre-sorting. Custom mode compiles a subset of Apache LogFormat and NGINX log_format directives (including %{Referer}i, %{User-Agent}i, %>s, %b, %D, $body_bytes_sent, and friends) into a regex on the fly, so you can paste the exact LogFormat string from your httpd.conf or nginx.conf and parse whatever it produces. Each parsed row exposes the client IP, the ident and authenticated user fields, the original CLF timestamp plus a normalized ISO UTC timestamp, the request method, path, and protocol, the HTTP status code (color coded by class), the response size in bytes, the referer, and the user agent (with a built-in family bucket that recognizes Chrome, Edge, Safari, Firefox, curl, Googlebot, Bingbot, and other common crawlers). On top of the per-row table sits a fleet-wide summary: total lines, parsed count, parse errors, unique IPs, unique status codes, total bytes served, average response size, the parsed time window, a status class distribution across 1xx, 2xx, 3xx, 4xx, 5xx, and the top status codes, IPs, paths, methods, and user-agent families across the whole input. The parsed rows export as JSON or CSV with a single click so the same data can move into a spreadsheet, a notebook, or a follow-up SIEM query. Useful when grep is not enough: triaging a traffic spike, hunting for the path that is generating 5xx errors, spotting the IP behind a 4xx flood, finding the user agent that hammers an endpoint, or just turning a confusing log paste into a clean table. Nothing is uploaded; parsing runs entirely on the device.

Free to use. Works in your browser. No signup, no login.