Grok Pattern Tester

How to use

1. 1Paste or type a grok pattern into the first box, using %{SYNTAX:field} references for the parts you want to capture, or load one of the built-in samples.
2. 2Paste a representative log line into the second box. The pattern is matched anywhere in the line, the same default the Logstash grok filter uses.
3. 3Read the extracted fields table: each captured field is listed with its value, and an int or float hint shows the value coerced to a number.
4. 4Use the field name syntax %{SYNTAX:name} to capture a value and %{SYNTAX} without a name to match without capturing, then add :int or :float to coerce numbers.
5. 5Copy the captured fields as JSON, or copy the compiled regular expression to reuse the same matching logic in code or another regex tool.
6. 6If there is no match, compare the compiled expression shown below against your line: literal brackets, dots, and slashes must appear in both. The pattern and line stay in your browser.

About this tool

Grok Pattern Tester is a browser-based grok debugger for the pattern language that Logstash, Elasticsearch ingest pipelines, Filebeat, and similar log shippers use to turn an unstructured log line into structured, named fields. A grok pattern is built from references written as %{SYNTAX}, %{SYNTAX:field}, or %{SYNTAX:field:int}, mixed with ordinary text and regular-expression syntax. Each SYNTAX name, for example IP, WORD, NUMBER, TIMESTAMP_ISO8601, or LOGLEVEL, is itself defined as a regular expression that may reference other patterns, and the grok engine resolves those references until the whole thing becomes one regular expression that it matches against the line. This tool reproduces exactly that process locally. It ships a practical subset of the standard Logstash core patterns, the ones that appear in almost every real-world grok expression, and a compiler that expands every %{...} reference recursively into a native JavaScript regular expression using named capture groups. You paste a grok pattern and a sample log line, and it shows three things: the fields the pattern captured, with each value and whether the int or float hint coerced it to a number; the literal text the pattern matched; and the full compiled regular expression, which you can copy and reuse anywhere a plain regex is accepted. The matcher is unanchored by default, the same behavior as the Logstash grok filter, so a pattern matches if it appears anywhere in the line; you add ^ and $ yourself when you need a strict full-line match. Errors are explained rather than swallowed: a reference to an unknown pattern name names the missing pattern, a self-referential definition is caught as a cycle instead of hanging the browser, and a pattern that compiles but produces an invalid regular expression (usually an unbalanced bracket in your own literal text) is reported with the compiled output shown so you can find the problem. Built-in samples cover an NGINX or Apache combined access log, a syslog line, an application log with a level and thread, and a simple key-equals-value line, so you can see a working pattern immediately. This is a tester and an explainer, not a log pipeline: it does not read files, run a Logstash configuration, or ship logs anywhere. The pattern and the log line you enter are matched entirely in your browser with the native RegExp engine and are never uploaded.

Free to use. Works in your browser. No signup, no login.