Choose a log file for reading in chunks or paste a smaller sample. Compare request counts and 4xx/5xx totals by path, then inspect the reported error or unrecognized lines.
Runs locally in your browserChoose an access log or JSON Lines file, or paste a smaller sample below.
| Path | Requests | 4xx | 5xx |
|---|---|---|---|
| No log analyzed yet. | |||
The parser recognizes common combined log fields and common JSON keys such as status, path, method, and ip. It is an operational summary, not a security incident detector.
Log Parser turns a combined access log or a JSON Lines file into a one-screen summary: lines recognized and unrecognized, 4xx/5xx counts, unique IPs, the busiest request paths, and the lines that need a second look.
Everything runs in this browser tab. Files are read in 1 MB chunks instead of being uploaded, and the output is a read-only report you can copy out — nothing is filtered, merged or rewritten.
A line is treated as a combined access-log entry when it matches the usual Nginx/Apache shape, for example 203.0.113.5 - - [25/Aug/2026:10:12:33 +0000] "GET /health HTTP/1.1" 200 16 "-" "curl/8.0". The referrer and user-agent fields may be missing. Lines that start with { are parsed as JSON Lines records when they carry at least one known key: status, statusCode or response.status; path, url or request.path; method; ip, remote_addr or client.ip; level or severity; message or msg; timestamp or time.
Everything else is counted as unrecognized and quoted back with its line number, so a line is never silently dropped. Syslog, Windows Event Log, CSV and pretty-printed JSON are outside both families — convert them to JSON Lines first.
Paths are counted after the query string is removed, so /api/projects?page=2 and /api/projects share one row. The table shows up to 12 paths sorted by traffic, each with its own 4xx and 5xx tally; the summary figures cover the whole file, and unique IPs are counted over recognized lines.
Notable lines collects up to 24 entries: 4xx and 5xx responses, records whose level or message reads like an error (error, fatal, exception, critical), and lines that could not be parsed. A - in the status column leaves that response out of the 4xx/5xx counts. This is an operational summary, not an incident-forensics or security-monitoring tool.
Files are read with the browser's FileReader in 1 MB chunks and streamed through the same parser as pasted text, so memory stays flat. In a desktop Chrome test, a 12 MB log with 120,000 lines produced its summary in about 0.2 seconds.
Because nothing is uploaded, the tool keeps working offline and is safe for logs you would rather not send to a third party. It is still a snapshot: there is no history, no filtering and no per-IP breakdown, and Copy summary exports the headline figures as plain text rather than the full table.