Syslog Message Parser

How to use

1. 1Paste one or more syslog messages into the box, one per line, or load the RFC 5424 or RFC 3164 sample.
2. 2Leave the format on Auto-detect to sort each line by its shape, or pin it to RFC 5424 or RFC 3164 if you know the source.
3. 3Read each message card: the decoded priority with its facility and severity, the timestamp normalized to ISO where possible, the hostname, app name or tag, process ID, and message.
4. 4For RFC 5424 lines, inspect the structured-data block, where each SD-ID and its quoted parameters are listed with escapes resolved.
5. 5Check the severity and facility breakdown tables to see the spread of levels across the batch, and the notes on each card for soft warnings.
6. 6Review the parse errors panel for any line that fails, then use Copy JSON to export every parsed message as structured data.

About this tool

Syslog Message Parser takes the raw syslog lines that Linux hosts, routers, firewalls, and network appliances emit, and breaks each one into the fields you actually need to read. It handles both wire formats. RFC 5424, the modern IETF format from 2009, has a strict shape: an angle-bracketed priority, a version number, an RFC 3339 timestamp, a hostname, an app name, a process ID, a message ID, a structured-data block, and the free-text message. RFC 3164, the original BSD format that is still the default on a lot of equipment, is looser: an optional priority, a Mmm dd hh:mm:ss timestamp with no year and no timezone, a hostname, a tag that often carries a process ID in square brackets, and then the message. Auto-detect reads the priority first and then picks the format by looking at what follows it, a version digit for RFC 5424 or a month name for RFC 3164, so a mixed paste from several sources is sorted out line by line. The centerpiece is the priority decode. The number in angle brackets, the PRI, is not arbitrary: it equals the facility times eight plus the severity. The tool splits it back apart, so a PRI of 34 is shown as facility 4 (auth) and severity 2 (critical), and it labels all 24 facilities (kern through local7) and all 8 severities (emergency through debug) with both the short keyword and the standard meaning. Each parsed message is laid out as a labelled card with a colored severity chip, every header field, and the decoded facility and severity side by side. For RFC 5424 the structured-data block is fully parsed: each SD-ID and its quoted parameters are pulled out, with the defined backslash escapes for quote, backslash, and closing bracket resolved correctly, so a value that contains spaces or brackets survives intact. Timestamps are normalized to ISO 8601 where possible; RFC 5424 times carry their own timezone, while RFC 3164 times have neither a year nor a zone, so the tool attaches the current year and reads the wall time as UTC and says so rather than guessing a locale. It is a linter as well as a reader. It flags the mistakes that trip up collectors: a PRI above 191, a PRI with no closing bracket, a missing version on an RFC 5424 line, a malformed timestamp, a missing or malformed structured-data block, an unterminated quoted value, and a line with no recognizable structure. When the parse is clean, every message exports as a structured JSON array carrying the priority, the numeric and named facility and severity, the version, both the raw and ISO timestamps, the hostname, app name, process ID, message ID, structured data as nested objects, and the message text, ready for a script, a test fixture, or a spreadsheet. One honest limit: this reads the syslog text you paste, it is not a syslog server. It does not listen on UDP 514, receive from rsyslog or journald, or store anything. Everything runs locally in your browser, so the messages you paste are never uploaded or logged.

Free to use. Works in your browser. No signup, no login.